GitHub Advisoryadvisory · PyPI

GHSA-9v8h-57gv-qch6 Django vulnerable to Denial of Service via i18n middleware component

HIGH Published 2022-05-01 Modified 2024-11-18 Official page ↗
Aliases
CVE-2007-5712
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-04-29

Affected packages

• PyPI Django: >= 0.96.0, < 0.96.1 → fixed in 0.96.1 • PyPI Django: >= 0.95, < 0.95.2 → fixed in 0.95.2 • PyPI Django: >= 0.91.0, < 0.91.1 → fixed in 0.91.1

Description

The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.

Related

Alias · CVE (1)

  • CVE-2007-5712 The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References