CVE-2011-4137 Denial of service in django
MediumCVSS 5.0
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | < 1.2.7 | 1.2.7 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | >= 1.3, < 1.3.1 | 1.3.1 |
| pypi django(PyPI) | = 1.3 | No fix listed |
| debian/python-django(Debian:12) | < 1.3.1-1 | 1.3.1-1 |
| debian/python-django(Debian:13) | < 1.3.1-1 | 1.3.1-1 |
| debian/python-django(Debian:14) | < 1.3.1-1 | 1.3.1-1 |
| djangoproject django | <= 1.2.6 | No fix listed |
| djangoproject django | = 0.91 | No fix listed |
| djangoproject django | = 0.95 | No fix listed |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| djangoproject django | = 0.95.1 | No fix listed |
| djangoproject django | = 0.96 | No fix listed |
| djangoproject django | = 1.0 | No fix listed |
| djangoproject django | = 1.0.1 | No fix listed |
| djangoproject django | = 1.0.2 | No fix listed |
| djangoproject django | = 1.1 | No fix listed |
| djangoproject django | = 1.1.0 | No fix listed |
| djangoproject django | = 1.1.2 | No fix listed |
| djangoproject django | = 1.1.3 | No fix listed |
| djangoproject django | = 1.2 | No fix listed |
| djangoproject django | = 1.2.1 | No fix listed |
| djangoproject django | = 1.2.1-2 | No fix listed |
| djangoproject django | = 1.2.2 | No fix listed |
| djangoproject django | = 1.2.3 | No fix listed |
| djangoproject django | = 1.2.4 | No fix listed |
| djangoproject django | = 1.2.5 | No fix listed |
| djangoproject django | = 1.3 | No fix listed |
| djangoproject django | = 1.3-alpha1 | No fix listed |
| djangoproject django | = 1.3-alpha2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugzilla.redhat.com issue-tracking patch
- github.com vendor-advisory
- github.com product
- github.com
- openSUSE-SU-2012:0653 vendor-advisory
- www.djangoproject.com patch technical-description vendor-advisory
- www.djangoproject.com patch technical-description
- [oss-security] 20110911 CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list patch
- [oss-security] 20110913 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list patch
- [oss-security] 20110916 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list
- DSA-2332 vendor-advisory
- 46614 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2011-4137 vendor-advisory
- bugs.debian.org issue-tracking