PT-2014-3649 · Django Software Foundation+1 · Django+1

David Wilson · Published 2014-08-26 · Updated 2022-05-14 · CVE-2014-0481

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.4.14 Django versions 1.5.x prior to 1.5.9 Django versions 1.6.x prior to 1.6.6 Django versions 1.7 before release candidate 3

Description The issue concerns the default configuration of the file upload handling system, which uses a sequential file name generation process when a file with a conflicting name is uploaded. This allows remote attackers to cause a denial of service by consuming CPU resources through uploading multiple files with the same name.

Recommendations For Django versions prior to 1.4.14, update to version 1.4.14 or later. For Django versions 1.5.x prior to 1.5.9, update to version 1.5.9 or later. For Django versions 1.6.x prior to 1.6.6, update to version 1.6.6 or later. For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-399

CWE-400

Related Identifiers

CVE-2014-0481

DLA-65-1

DSA-3010-1

GHSA-296W-6QHQ-GF92

MGASA-2014-0366

PYSEC-2014-5

SUSE-SU-2015:0563-1

SUSE-SU-2015:0695-1

USN-2347-1

Affected Products

Django

Ubuntu

References · 28

• https://osv.dev/vulnerability/USN-2347-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0481 · Vendor Advisory
• https://djangoproject.com/weblog/2014/aug/20/security · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0481 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0366 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0481 · Vendor Advisory
• http://debian.org/security/2014/dsa-3010 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2347-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0366.html · Security Note
• https://ubuntu.com/security/CVE-2014-0483 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0480 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-296w-6qhq-gf92 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0481 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0481 · Security Note