PT-2012-4717 · Django · Django

Jeroen Dekkers · Published 2012-07-31 · Updated 2022-05-17 · CVE-2012-3444

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.3.x through 1.3.2 Django versions 1.4.x through 1.4.1

Description The issue allows remote attackers to cause a denial of service, specifically process or thread consumption, via a large TIFF image. This is due to the get image dimensions function using a constant chunk size in all attempts to determine dimensions.

Recommendations For Django versions 1.3.x through 1.3.2, update to version 1.3.2 or later. For Django versions 1.4.x through 1.4.1, update to version 1.4.1 or later. As a temporary workaround, consider restricting the upload of large TIFF images to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-3444

DSA-2529-1

GHSA-5H2Q-4HRP-V9RR

PYSEC-2012-4

Affected Products

Django

References · 19

• https://security-tracker.debian.org/tracker/CVE-2012-3444 · Vendor Advisory
• https://djangoproject.com/weblog/2012/jul/30/security-releases-issued · Vendor Advisory
• http://debian.org/security/2012/dsa-2529 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3444 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:143 · Vendor Advisory
• http://ubuntu.com/usn/USN-1560-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5h2q-4hrp-v9rr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-4 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3444 · Vendor Advisory
• https://github.com/django/django · Note
• https://github.com/django/django/commit/dd16b17099b7d86f27773df048c5014cf439b282 · Note
• https://github.com/django/django/commit/c14f325c4eef628bc7bfd8873c3a72aeb0219141 · Note
• https://github.com/django/django/commit/b2eb4787a0fff9c9993b78be5c698e85108f3446 · Note
• https://github.com/django/django/commit/da33d67181b53fe6cc737ac1220153814a1509f6 · Note