CVE-2007-5712 Django vulnerable to Denial of Service via i18n middleware component
LowCVSS 2.6
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 0.96.0, < 0.96.1 | 0.96.1 |
| pypi django(PyPI) | = 0.96.0 | No fix listed |
| pypi django(PyPI) | >= 0.95, < 0.95.2 | 0.95.2 |
| pypi django(PyPI) | >= 0.91.0, < 0.91.1 | 0.91.1 |
| pypi django(PyPI) | = 0.91.0 | No fix listed |
| pypi django(PyPI) | < 1.1 | 1.1 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| django project django | = 0.91 | No fix listed |
| django project django | = 0.95 | No fix listed |
| django project django | = 0.95.1 | No fix listed |
| django project django | = 0.96 | No fix listed |
| debian/python-django(Debian:12) | < 0.96-1.1 | 0.96-1.1 |
| debian/python-django(Debian:13) | < 0.96-1.1 | 0.96-1.1 |
| debian/python-django(Debian:14) | < 0.96-1.1 | 0.96-1.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- django-i18n-dos(38143) vdb-entry
- github.com product
- github.com
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- FEDORA-2007-2788 vendor-advisory
- FEDORA-2007-3157 vendor-advisory
- sourceforge.net
- DSA-1640 patch vendor-advisory
- www.djangoproject.com patch technical-description
- 27435 patch third-party-advisory vendor-advisory
- 26227 vdb-entry
- 27597 third-party-advisory vendor-advisory
- 31961 third-party-advisory vendor-advisory
- ADV-2007-3660 vdb-entry vendor-advisory
- ADV-2007-3661 vdb-entry vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2007-5712 vendor-advisory
- bugs.debian.org issue-tracking