CVE-2014-3730: Canonical Ubuntu Linux

Medium severity, CVSS 4.3. EPSS: 3.1% chance of exploitation in the next 30 days.

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."

Affected products

• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 12.10 only; version 13.10 only; version 14.04 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• Djangoproject Django: version 1.4 only; version 1.4.1 only; version 1.4.2 only; version 1.4.4 only; version 1.4.5 only; version 1.4.6 only; …
• Opensuse Opensuse: version 12.3 only; version 13.1 only

Published 2014-05-16. Last modified 2026-06-17.