CVE-2012-3443 Django Image Field Vulnerable to Image Decompression Bombs
MediumCVSS 5.0
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | < 1.3.2 | 1.3.2 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | = 1.2.7 | No fix listed |
| pypi django(PyPI) | = 1.3 | No fix listed |
| pypi django(PyPI) | = 1.3.1 | No fix listed |
| pypi django(PyPI) | >= 1.4, < 1.4.1 | 1.4.1 |
| pypi django(PyPI) | = 1.4 | No fix listed |
| debian/python-django(Debian:12) | < 1.4.1-1 | 1.4.1-1 |
| debian/python-django(Debian:13) | < 1.4.1-1 | 1.4.1-1 |
| debian/python-django(Debian:14) | < 1.4.1-1 | 1.4.1-1 |
Show 29 more
| Product | Affected versions | Fixed in |
|---|---|---|
| djangoproject django | <= 1.3 | No fix listed |
| djangoproject django | = 0.95 | No fix listed |
| djangoproject django | = 0.96 | No fix listed |
| djangoproject django | = 1.0 | No fix listed |
| djangoproject django | = 1.0-alpha1 | No fix listed |
| djangoproject django | = 1.0-alpha2 | No fix listed |
| djangoproject django | = 1.0-beta | No fix listed |
| djangoproject django | = 1.0-beta2 | No fix listed |
| djangoproject django | = 1.0.1 | No fix listed |
| djangoproject django | = 1.0.2 | No fix listed |
| djangoproject django | = 1.1 | No fix listed |
| djangoproject django | = 1.1-alpha1 | No fix listed |
| djangoproject django | = 1.1-beta1 | No fix listed |
| djangoproject django | = 1.1-rc1 | No fix listed |
| djangoproject django | = 1.1.2 | No fix listed |
| djangoproject django | = 1.1.3 | No fix listed |
| djangoproject django | = 1.1.4 | No fix listed |
| djangoproject django | = 1.2 | No fix listed |
| djangoproject django | = 1.2-beta1 | No fix listed |
| djangoproject django | = 1.2-rc1 | No fix listed |
| djangoproject django | = 1.2-alpha1 | No fix listed |
| djangoproject django | = 1.2.2 | No fix listed |
| djangoproject django | = 1.2.4 | No fix listed |
| djangoproject django | = 1.2.5 | No fix listed |
| djangoproject django | = 1.2.6 | No fix listed |
| djangoproject django | = 1.2.7 | No fix listed |
| djangoproject django | = 1.3-alpha1 | No fix listed |
| djangoproject django | = 1.3-beta1 | No fix listed |
| djangoproject django | = 1.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com product
- github.com
- www.debian.org
- www.djangoproject.com patch technical-description vendor-advisory
- www.mandriva.com
- www.openwall.com
- www.openwall.com
- www.ubuntu.com
- DSA-2529 vendor-advisory
- MDVSA-2012:143 vendor-advisory
- [oss-security] 20120730 CVE Request: Django 1.3.1 and 1.4.0 security issues mailing-list
- [oss-security] 20120730 Re: CVE Request: Django 1.3.1 and 1.4.0 security issues mailing-list
- USN-1560-1 vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2012-3443 vendor-advisory
- bugs.debian.org issue-tracking