logo

Database

Asymmetric denial of service In django

Description

Django denial of service via file upload naming The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2014-04812. NVD-2014-04813. OSV-2014-04814. OSV-DEBIAN-2014-04815. GCVE-2014-04816. SECURITY-TRACKER-CVE-2014-0481

References

1. https://github.com/django/django/commit/26cd48e166ac4d84317c8ee6d63ac52a87e8da992. https://github.com/django/django/commit/30042d475bf084c6723c6217a21598d9247a9c413. https://github.com/django/django/commit/dd0c3f4ee1a30c1a1e6055061c6ba6e58c6b54d14. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-5.yaml5. https://www.djangoproject.com/weblog/2014/aug/20/security6. http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html7. http://www.debian.org/security/2014/dsa-3010

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.