PT-2009-5954

CVE-2009-3695

Publicado

2009-10-13

Atualizado

2022-05-02

Descrição por

CVSS 4.0

8.7

Alta

MétricasAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.0 through 1.0.3 Django versions 1.1 through 1.1.0

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by providing a crafted input to either the EmailField (email address) or URLField (URL) that triggers excessive backtracking in a regular expression.

Recommendations For Django versions 1.0 through 1.0.3, update to version 1.0.4 or later. For Django versions 1.1 through 1.1.0, update to version 1.1.1 or later.

Explorabilidade

Correção

Impactos

Pesquisadores

Steven M. Christey

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-400: Uncontrolled Resource Consumption

CWE-1333: Inefficient Regular Expression Complexity

Identificadores relacionados

CVE-2009-3695