{"id":"CVE-2014-1418","aliases":["DEBIAN-CVE-2014-1418","DSA-2934-1","EUVD-2014-0008","GHSA-q7q2-qf2q-rw3w","MGASA-2014-0231","PYSEC-2014-19","UBUNTU-CVE-2014-1418","USN-2212-1"],"status":"published","title":"Django Vulnerable to Cache Poisoning","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02617,"percentile":0.85556,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-349"],"published":"2014-05-14T00:00:00Z","modified":"2026-10-23T15:47:34Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.4.13","1.5.8","1.6.5","1.7b4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.6.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.6.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.6.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4"},{"fixed":"1.4.13"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7a1"},{"fixed":"1.7b4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3+squeeze10"}]}],"versions":["1.2.3-3","1.2.3-3+squeeze1","1.2.3-3+squeeze2","1.2.3-3+squeeze3","1.2.3-3+squeeze5","1.2.3-3+squeeze6","1.2.3-3+squeeze7","1.2.3-3+squeeze8","1.2.3-3+squeeze9"],"bundled":5},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u7"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7~bpo60+1"],"bundled":5},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4"},{"fixed":"1.4.13"}]}],"versions":["1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.8"}]}],"versions":["1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.5"}]}],"versions":["1.6","1.6.1","1.6.2","1.6.3","1.6.4"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7a1"},{"fixed":"1.7b4"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"python-django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4"},{"fixed":"1.4.13"},{"introduced":"1.5"},{"fixed":"1.5.8"},{"introduced":"1.6"},{"fixed":"1.6.5"},{"introduced":"1.7a0"},{"fixed":"1.7b4"}]}],"versions":["1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.6","1.6.1","1.6.2","1.6.3","1.6.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.3"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.3"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"djangoproject","product":"django"}],"references":[{"url":"http://secunia.com/advisories/61281","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2934","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://ubuntu.com/usn/usn-2212-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/14/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1418","tags":["advisory"]},{"url":"https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769","tags":["web"]},{"url":"https://github.com/django/django/commit/28e23306aa53bbbb8fb87db85f99d970b051026c","tags":["web"]},{"url":"https://github.com/django/django/commit/4001ec8698f577b973c5a540801d8a0bbea1205b","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-19.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q7q2-qf2q-rw3w","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-1418","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0231.html","tags":["advisory"]},{"url":"http://www.ubuntu.com/usn/usn-2212-1/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1418","tags":["report"]},{"url":"https://github.com/django/django/blob/master/django/http/utils.py#L73","tags":["report"]},{"url":"https://www.djangoproject.com/weblog/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2212-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1418","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-1418","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2014-05-16T15:00:00Z","modified":"2024-08-06T09:42:35.452Z","updated_at":"2026-11-02T14:33:46.310517Z"}],"euvd":[{"id":"EUVD-2014-0008","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2014-05-16T15:00:00Z","modified":"2024-08-06T09:42:35Z","updated_at":"2026-11-03T01:57:18.349202Z"}],"ghsa":[{"id":"GHSA-q7q2-qf2q-rw3w","title":"Django Vulnerable to Cache Poisoning","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2022-05-17T03:07:00Z","modified":"2024-11-18T16:26:24Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T14:38:19.029049Z"}],"nvd":[{"id":"CVE-2014-1418","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2014-05-16T15:55:04.597Z","modified":"2026-06-17T00:04:52.14Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"GHSA-q7q2-qf2q-rw3w","title":"Django Vulnerable to Cache Poisoning","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2022-05-17T03:07:00Z","modified":"2024-11-28T05:41:16.988361Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"CVE-2014-1418","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2014-05-16T15:55:04Z","modified":"2026-04-16T06:23:40.750016346Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-1418","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2014-05-16T15:55:04.597Z","modified":"2026-10-23T15:47:34.951439897Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2934-1","title":"python-django - security update","status":"published","published":"2014-05-19T00:00:00Z","modified":"2026-03-09T01:23:37.983814Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0231","title":"Updated python-django package fix two vulnerabilities","description":"Updated python-django and python-dgango14 packages fix security\nvulnerabilities:\n\nStephen Stewart, Michael Nelson, Natalia Bidart and James Westby\ndiscovered that Django improperly removed Vary and Cache-Control headers\nfrom HTTP responses when replying to a request from an Internet Explorer\nor Chrome Frame client. An attacker may use this to retrieve private data\nor poison caches. This update removes workarounds for bugs in Internet\nExplorer 6 and 7 (CVE-2014-1418).\n\nPeter Kuma and Gavin Wahl discovered that Django did not correctly\nvalidate some malformed URLs, which are accepted by some browsers. An\nattacker may use this to cause unexpected redirects (CVE-2014-3730).\n","status":"published","published":"2014-05-19T18:53:32Z","modified":"2026-04-16T06:26:11.442069152Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"PYSEC-2014-19","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2014-05-16T15:55:00Z","modified":"2026-06-10T17:00:53.784958064Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"UBUNTU-CVE-2014-1418","description":"Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.","status":"published","published":"2014-05-14T00:00:00Z","modified":"2026-02-04T03:09:14.954763Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2212-1","title":"python-django vulnerabilities","description":"Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby\ndiscovered that Django improperly removed Vary and Cache-Control headers\nfrom HTTP responses when replying to a request from an Internet Explorer\nor Chrome Frame client. An attacker may use this to retrieve private data\nor poison caches. This update removes workarounds for bugs in Internet\nExplorer 6 and 7. (CVE-2014-1418)\n\nPeter Kuma and Gavin Wahl discovered that Django did not correctly\nvalidate some malformed URLs, which are accepted by some browsers. An\nattacker may use this to cause unexpected redirects. An update has been\nprovided for 12.04 LTS, 12.10, 13.10, and 14.04 LTS; this issue remains\nunfixed for 10.04 LTS as no \"is_safe_url()\" functionality existed in\nthis version.\n","status":"published","published":"2014-05-15T01:26:18Z","modified":"2026-02-10T04:40:48Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}