Input validation error in Django - CVE-2012-3443
Published: July 31, 2012 / Updated: July 28, 2020
Vulnerability identifier: #VU32759
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-3443
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
Affected software
Django
py-django (Alpine package)
Django
Fedora
py-django (Alpine package)
Django
Fedora
How to mitigate CVE-2012-3443
Install update from vendor's website.
Django - update to 1.3.2
py-django (Alpine package) - update to 1.4.1-r0
Django - update to 1.3.2-1.el6
py-django (Alpine package) - update to 1.4.1-r0
Django - update to 1.3.2-1.el6
External References
- http://www.debian.org/security/2012/dsa-2529
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:143
- http://www.openwall.com/lists/oss-security/2012/07/31/1
- http://www.openwall.com/lists/oss-security/2012/07/31/2
- http://www.ubuntu.com/usn/USN-1560-1
- https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/