GitHub Advisoryadvisory · PyPI

GHSA-5h2q-4hrp-v9rr Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

HIGH Published 2022-05-17 Modified 2024-09-16 Official page ↗
Aliases
CVE-2012-3444
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-119
Reviewed
2023-04-21

Affected packages

• PyPI Django: < 1.3.2 → fixed in 1.3.2 • PyPI Django: >= 1.4, < 1.4.1 → fixed in 1.4.1

Description

The `get_image_dimensions` function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.

Related

Alias · CVE (1)

  • CVE-2012-3444 The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References