PT-2014-3649 · Django Software Foundation+1 · Django+1

David Wilson · Publicado 2014-08-26 · Atualizado 2022-05-14 · CVE-2014-0481

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.4.14 Django versions 1.5.x prior to 1.5.9 Django versions 1.6.x prior to 1.6.6 Django versions 1.7 before release candidate 3

Description The issue concerns the default configuration of the file upload handling system, which uses a sequential file name generation process when a file with a conflicting name is uploaded. This allows remote attackers to cause a denial of service by consuming CPU resources through uploading multiple files with the same name.

Recommendations For Django versions prior to 1.4.14, update to version 1.4.14 or later. For Django versions 1.5.x prior to 1.5.9, update to version 1.5.9 or later. For Django versions 1.6.x prior to 1.6.6, update to version 1.6.6 or later. For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-399

CWE-400

Identificadores relacionados

CVE-2014-0481

DLA-65-1

DSA-3010-1

GHSA-296W-6QHQ-GF92

MGASA-2014-0366

PYSEC-2014-5

SUSE-SU-2015:0563-1

SUSE-SU-2015:0695-1

USN-2347-1

Produtos afetados

Django

Ubuntu

Referências · 28

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/dd0c3f4ee1a30c1a1e6055061c6ba6e58c6b54d1 · Nota
• https://github.com/django/django/commit/30042d475bf084c6723c6217a21598d9247a9c41 · Nota
• https://github.com/django/django/commit/26cd48e166ac4d84317c8ee6d63ac52a87e8da99 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-5.yaml · Nota
• https://osv.dev/vulnerability/USN-2347-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=13963 · Nota
• https://security-tracker.debian.org/tracker/CVE-2014-0481 · Aviso do Fabricante
• https://djangoproject.com/weblog/2014/aug/20/security · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-0481 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0366 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-0481 · Aviso do Fabricante
• http://secunia.com/advisories/61276 · Nota
• http://debian.org/security/2014/dsa-3010 · Aviso do Fabricante