PT-2013-3139 · Django · Django
CVE-2013-1443
·
Published
2013-09-19
·
Updated
2022-05-17
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 1.4.x through 1.4.7
Django versions 1.5.x through 1.5.3
Django versions 1.6.x through 1.6 beta 3
Description
The issue allows remote attackers to cause a denial of service by consuming CPU resources. This is achieved by providing a long password that is then hashed, exploiting the authentication framework in Django.
Recommendations
For Django versions 1.4.x through 1.4.7, update to version 1.4.8 or later.
For Django versions 1.5.x through 1.5.3, update to version 1.5.4 or later.
For Django versions 1.6.x through 1.6 beta 3, update to version 1.6 beta 4 or later.
Fix
DoS
Resource Exhaustion
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Django