id: PYSEC-2014-20
details: The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5
  before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate
  URLs, which allows remote attackers to conduct open redirect attacks via a malformed
  URL, as demonstrated by "http:\\\djangoproject.com."
affected:
- package:
    name: django
    ecosystem: PyPI
    purl: pkg:pypi/django
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "1.4"
    - fixed: 1.4.13
    - introduced: "1.5"
    - fixed: 1.5.8
    - introduced: "1.6"
    - fixed: 1.6.5
    - introduced: 1.7a0
    - fixed: 1.7b4
  versions:
  - "1.4"
  - 1.4.1
  - 1.4.10
  - 1.4.11
  - 1.4.12
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.6
  - 1.4.7
  - 1.4.8
  - 1.4.9
  - "1.5"
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - 1.5.5
  - 1.5.6
  - 1.5.7
  - "1.6"
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
references:
- type: WEB
  url: http://ubuntu.com/usn/usn-2212-1
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2014/05/15/3
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2014/05/14/10
- type: ADVISORY
  url: http://www.debian.org/security/2014/dsa-2934
- type: WEB
  url: http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
- type: WEB
  url: http://www.securityfocus.com/bid/67410
- type: ADVISORY
  url: http://secunia.com/advisories/61281
- type: ADVISORY
  url: https://github.com/advisories/GHSA-vq3h-3q7v-9prw
aliases:
- CVE-2014-3730
- GHSA-vq3h-3q7v-9prw
modified: "2021-09-01T08:18:55.675902Z"
published: "2014-05-16T15:55:00Z"