Django Cross-Site Request Forgery Vulnerability

Release date:
Updated on:

Affected Systems:
Django 1.6.x
Django 1.5.x
Django 1.4.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 67040
CVE (CAN) ID: CVE-2014-0473
 
Django is an open-source Web application framework driven by Python programming language.
 
The cache framework of Django versions earlier than 1.4.11, 1.5.6, 1.6.3, 1.7 beta 2 re-uses the cached CSRF token for all anonymous users. This allows remote attackers to read the CSRF cookies of anonymous users, this bypasses CSRF protection.

Recommended reading:

Install Nginx + uWSGI + Django on Ubuntu Server 12.04

Django tutorial

Build a Django Python MySQL Linux development environment

 

<* Source: Paul McMillan

Link: http://secunia.com/advisories/58201/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Django
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.djangoproject.com/
Https://www.djangoproject.com/weblog/2014/apr/21/security/

Django details: click here
Django's: click here