GitHub Advisoryadvisory · PyPI

GHSA-g8xg-jgj6-49r3 Django is vulnerable to Denial of Service attack in formset

MEDIUM Published 2022-05-05 Modified 2024-09-18 Official page ↗
Aliases
CVE-2013-0306
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2023-08-17

Affected packages

• PyPI Django: >= 1.3, < 1.3.6 → fixed in 1.3.6 • PyPI Django: >= 1.4, < 1.4.4 → fixed in 1.4.4

Description

The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.

Related

Alias · CVE (1)

  • CVE-2013-0306 The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References