CVE-2010-4535

2010-12-2200:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.132 Low

EPSS

Percentile

95.5%

JSON

The password reset functionality in django.contrib.auth in Django before
1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate
the length of a string representing a base36 timestamp, which allows remote
attackers to cause a denial of service (resource consumption) via a URL
that specifies a large base36 integer.

OSVersionArchitecturePackageVersionFilename
ubuntu9.10noarchpython-django< 1.1.1-1ubuntu1.1UNKNOWN
ubuntu10.04noarchpython-django< 1.1.1-2ubuntu1.2UNKNOWN
ubuntu10.10noarchpython-django< 1.2.3-1ubuntu0.2.10.10.1UNKNOWN
ubuntu11.04noarchpython-django< 1.2.3-1ubuntu0.2.11.04.1UNKNOWN
ubuntu11.10noarchpython-django< 1.2.3-1ubuntu0.2.11.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	9.10	noarch	python-django	< 1.1.1-1ubuntu1.1	UNKNOWN
ubuntu	10.04	noarch	python-django	< 1.1.1-2ubuntu1.2	UNKNOWN
ubuntu	10.10	noarch	python-django	< 1.2.3-1ubuntu0.2.10.10.1	UNKNOWN
ubuntu	11.04	noarch	python-django	< 1.2.3-1ubuntu0.2.11.04.1	UNKNOWN
ubuntu	11.10	noarch	python-django	< 1.2.3-1ubuntu0.2.11.04.1	UNKNOWN