{"id":"CVE-2014-0474","published":"2014-04-23T14:00:00Z","modified":"2024-08-06T09:20:18Z","title":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11…","vendor":null,"product":null,"tier":"tail","description":{"text":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04885,"percentile":0.9207,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.ubuntu.com/usn/USN-2169-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://www.djangoproject.com/weblog/2014/apr/21/security/","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0457.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/61281","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.debian.org/security/2014/dsa-2934","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0456.html","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.41}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":["<1.4.11",">=1.5, <1.5.6",">=1.6, <1.6.3"],"patched":["1.4.11","1.5.6","1.6.3"],"from":["GHSA-wqjj-hx84-v449","PYSEC-2014-3"],"provenance":"source"}],"euvd":{"id":"EUVD-2014-0011","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2011-4137","parents":[{"from":"CVE-2011-4137","to":"CVE-2014-0474","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/db/models/fields/__init__.py"],"commits":["https://github.com/django/django/commit/1a76dbefdfc60e2d5954c0ba614c3d054ba9c3f0","https://github.com/django/django/commit/7268f8af86186518821d775c530d5558fd726930","https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292","https://github.com/django/django/commit/985434fb1d6bf2335bf96c6ebf91c3674f1f399f"],"basis":"rarely changed file"}]},{"from":"CVE-2011-4138","to":"CVE-2014-0474","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/db/models/fields/__init__.py"],"commits":["https://github.com/django/django/commit/1a76dbefdfc60e2d5954c0ba614c3d054ba9c3f0","https://github.com/django/django/commit/7268f8af86186518821d775c530d5558fd726930","https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292","https://github.com/django/django/commit/985434fb1d6bf2335bf96c6ebf91c3674f1f399f"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2013-1443","published":"2013-09-23","fixed":"1.5.4","kev":false,"link":{"from":"CVE-2013-1443","to":"CVE-2014-0474","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.4.8","toFixed":"1.4.11","daysApart":212}]}},{"cve":"CVE-2014-0472","published":"2014-04-23","fixed":"1.6.3","kev":false},{"cve":"CVE-2014-0473","published":"2014-04-23","fixed":"1.6.3","kev":false},{"cve":"CVE-2014-0474","published":"2014-04-23","fixed":"1.6.3","kev":false},{"cve":"CVE-2014-0480","published":"2014-08-26","fixed":"1.6.6","kev":false},{"cve":"CVE-2014-0481","published":"2014-08-26","fixed":"1.6.6","kev":false},{"cve":"CVE-2014-1418","published":"2014-05-16","fixed":"1.7b4","kev":false}],"package":"PyPI:Django"}}