FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

django -- multiple vulnerabilities

Affected packages
1.6	<=	py26-django	<	1.6.3
1.6	<=	py27-django	<	1.6.3
1.6	<=	py31-django	<	1.6.3
1.6	<=	py32-django	<	1.6.3
1.6	<=	py33-django	<	1.6.3
1.6	<=	py34-django	<	1.6.3
1.5	<=	py26-django15	<	1.5.6
1.5	<=	py27-django15	<	1.5.6
1.5	<=	py31-django15	<	1.5.6
1.5	<=	py32-django15	<	1.5.6
1.5	<=	py33-django15	<	1.5.6
1.5	<=	py34-django15	<	1.5.6
1.4	<=	py26-django14	<	1.4.11
1.4	<=	py27-django14	<	1.4.11
1.4	<=	py31-django14	<	1.4.11
1.4	<=	py32-django14	<	1.4.11
1.4	<=	py33-django14	<	1.4.11
1.4	<=	py34-django14	<	1.4.11
		py26-django-devel	<	20140423,1
		py27-django-devel	<	20140423,1

Details

VuXML ID	59e72db2-cae6-11e3-8420-00e0814cab4e
Discovery	2014-04-21
Entry	2014-04-23
Modified	2014-04-30

The Django project reports:

These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and upgrade as soon as possible.

[source]

References

CVE Name	CVE-2014-0472
CVE Name	CVE-2014-0473
CVE Name	CVE-2014-0474
URL	https://www.djangoproject.com/weblog/2014/apr/21/security/