Django multiple module type conversion Vulnerability

Release date:
Updated on:

Affected Systems:
Django 1.6.x
Django 1.5.x
Django 1.4.x
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2014-0474
 
Django is an open-source Web application framework driven by Python programming language.
 
In versions earlier than Django 1.4.11, 1.5.6, 1.6.3, 1.7 beta 2, FilePathField, GenericIPAddressField, and IPAddressField do not correctly perform type conversion, this allows remote attackers to execute unauthorized database operations through MySQL type conversion.

Recommended reading:

Install Nginx + uWSGI + Django on Ubuntu Server 12.04

Django tutorial

Build a Django Python MySQL Linux development environment

 
<* Source: Benjamin Bach
Paul McMillan

Link: http://secunia.com/advisories/58201/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Django
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.djangoproject.com/
Https://www.djangoproject.com/weblog/2014/apr/21/security/

Django details: click here
Django's: click here