Detections
Analytics
Alpine: Django: security update to 1.5.7-r0 (deprecated)
medium Tenable Cloud Security Plugin ID 401217
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly
include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to
obtain sensitive information or poison the cache via a request from certain browsers. (CVE-2014-1418)
- The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5,
and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open
redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com." (CVE-2014-3730)
See Also
https://git.alpinelinux.org/aports/commit/?id=1609a4f801c6b7388a082fc592ca8322685417b3
https://git.alpinelinux.org/aports/commit/?id=b2f3e3ca9b80643b32cf3cf0040469654c4ad0e1
Plugin Details
Severity: Medium
ID: 401217
Version: Revision 1.24
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.04
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2014-1418
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/15/2014
Vulnerability Publication Date: 5/15/2014
Reference Information
CVE: CVE-2014-1418, CVE-2014-3730