8007 matches found
Authentication flaw
The authentication framework django.contrib.auth in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service CPU consumption via a long password which is then hashed...
dfnclient (>=0.0.1 <=0.4.6), django-afip (>=1.0.2 <=2.2.1) +2 more potentially affected by CVE-2013-2217 via suds-py3 (>=1.0.0.0 <=1.4.1.0)
suds-py3 PYPI version =1.0.0.0, =0.0.1, =1.0.2, =0.9.0, =0.0.1, =0.0.8 Source cves: CVE-2013-2217 Source advisory: OSV:PYSEC-2013-33...
PYSEC-2013-18
The authentication framework django.contrib.auth in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service CPU consumption via a long password which is then hashed...
CVE-2013-1443
CVE-2013-1443 affects Django’s authentication framework (django.contrib.auth) across Django 1.4.x < 1.4.8, 1.5.x < 1.5.4, and 1.6.x
CVE-2013-1443
The authentication framework django.contrib.auth in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service CPU consumption via a long password which is then hashed...
CVE-2013-1443
The authentication framework django.contrib.auth in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service CPU consumption via a long password which is then hashed...
CVE-2013-5750: Security issue in FOSUserBundle login form
Django recently released a new version of their framework to address a possible DOS attack when an attacker uses a very long password on a login form. One of the best practices for passwords is to store a hash of the password instead of the raw value. In Symfony, the encoders are responsible for...
FreeBSD : django -- denial-of-service via large passwords (05dc6efa-2370-11e3-95b7-00e0814cab4e)
The Django project reports : These releases address a denial-of-service attack against Django's authentication framework. All users of Django are encouraged to upgrade immediately. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
CVE-2013-1443
The authentication framework django.contrib.auth in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service CPU consumption via a long password which is then hashed...
Updated python-django package fixes multiple vulnerabilities
Updated python-django package fixes security vulnerabilities: Rainer Koirikivi discovered a directory traversal vulnerability with 'ssi' template tags in python-django, a high-level Python web development framework. It was shown that the handling of the 'ALLOWEDINCLUDEROOTS' setting, used to...
MGASA-2013-0283 Updated python-django package fixes security vulnerability
Rainer Koirikivi discovered a directory traversal vulnerability with 'ssi' template tags in python-django, a high-level Python web development framework. It was shown that the handling of the 'ALLOWEDINCLUDEROOTS' setting, used to represent allowed prefixes for the % ssi % template tag, is...
Updated python-django package fixes security vulnerability
Rainer Koirikivi discovered a directory traversal vulnerability with 'ssi' template tags in python-django, a high-level Python web development framework. It was shown that the handling of the 'ALLOWEDINCLUDEROOTS' setting, used to represent allowed prefixes for the % ssi % template tag, is...
Debian Security Advisory DSA 2529-1 (python-django - several vulnerabilities)
Jeroen Dekkers and others reported several vulnerabilities in Django, a Python Web framework. The Common Vulnerabilities and Exposures project defines the following issues: CVE-2012-3442Two functions do not validate the scheme of a redirect target, which might allow remote attackers to conduct...
Django密码哈希拒绝服务漏洞(CVE-2013-1443)
BUGTRAQ ID: 62409 CVE ID: CVE-2013-1443 Django是Python编程语言驱动的一个开源Web应用程序框架 Django 1.4.8 and 1.5.4之前版本在计算已提交密码的哈希时，django.contrib.auth中存在错误，通过发送较大的密码，攻击者可利用此漏洞造成受影响系统崩溃，导致拒绝服务 0 Django = 1.5.4 Django = 1.4.8 厂商补丁： Django ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.djangoproject.com/...
Debian DSA-2758-1 : python-django - denial of service
It was discovered that python-django, a high-level Python web develompent framework, is prone to a denial of service vulnerability via large passwords. A non-authenticated remote attacker could mount a denial of service by submitting arbitrarily large passwords, tying up server resources in the...
Debian: Security Advisory (DSA-2529-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 2758-1] python-django security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2758-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 17, 2013 http://www.debian.org/security/faq -...
[SECURITY] [DSA 2758-1] python-django security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2758-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 17, 2013 http://www.debian.org/security/faq -...
Patches for Django Framework Fix DoS Vuln
Developers behind the Web framework Django have pushed out a new build that fixes a handful of security issues, including a denial of service vulnerability in the framework’s password hasher. Django 1.4.8, Django 1.5.4, and Django 1.6 beta 4 were released over the weekend and users are urged to...
Debian Security Advisory DSA 2758-1 (python-django - denial of service)
It was discovered that python-django, a high-level Python web develompent framework, is prone to a denial of service vulnerability via large passwords. A non-authenticated remote attacker could mount a denial of service by submitting arbitrarily large passwords, tying up server resources in the...