PT-2012-4717 · Django · Django

Jeroen Dekkers · Publicado 2012-07-31 · Atualizado 2022-05-17 · CVE-2012-3444

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.3.x through 1.3.2 Django versions 1.4.x through 1.4.1

Description The issue allows remote attackers to cause a denial of service, specifically process or thread consumption, via a large TIFF image. This is due to the get image dimensions function using a constant chunk size in all attempts to determine dimensions.

Recommendations For Django versions 1.3.x through 1.3.2, update to version 1.3.2 or later. For Django versions 1.4.x through 1.4.1, update to version 1.4.1 or later. As a temporary workaround, consider restricting the upload of large TIFF images to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-3444

DSA-2529-1

GHSA-5H2Q-4HRP-V9RR

PYSEC-2012-4

Produtos afetados

Django

Referências · 19

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/dd16b17099b7d86f27773df048c5014cf439b282 · Nota
• https://github.com/django/django/commit/c14f325c4eef628bc7bfd8873c3a72aeb0219141 · Nota
• https://github.com/django/django/commit/b2eb4787a0fff9c9993b78be5c698e85108f3446 · Nota
• https://github.com/django/django/commit/da33d67181b53fe6cc737ac1220153814a1509f6 · Nota
• https://github.com/django/django/commit/9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2012-4.yaml · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-3444 · Aviso do Fabricante
• https://djangoproject.com/weblog/2012/jul/30/security-releases-issued · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2529 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-3444 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3444 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/07/31/1 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2012:143 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-1560-1 · Aviso do Fabricante