Django Vulnerable to MySQL Injection
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2014-0474US | high10.0 | — | ||
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 b… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-0456.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-0457.htmlWEB
- http://www.debian.org/security/2014/dsa-2934WEB
- http://www.ubuntu.com/usn/USN-2169-1WEB
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292WEB
- https://github.com/django/django/commit/985434fb1d6bf2335bf96c6ebf91c3674f1f399fWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan