#VU32759 Input validation error in Django - CVE-2012-3443 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32759

#VU32759 Input validation error in Django - CVE-2012-3443

Published: July 31, 2012 / Updated: July 28, 2020


Vulnerability identifier: #VU32759
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2012-3443
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Django
Software vendor:
Django Software Foundation

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.


Remediation

Install update from vendor's website.

External links