CVE-2011-4137

2011-10-1900:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.038 Low

EPSS

Percentile

91.7%

JSON

The verify_exists functionality in the URLField implementation in Django
before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt
access to an arbitrary URL with no timeout, which allows remote attackers
to cause a denial of service (resource consumption) via a URL associated
with (1) a slow response, (2) a completed TCP connection with no
application data sent, or (3) a large amount of application data, a related
issue to CVE-2011-1521.

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchpython-django< 1.1.1-2ubuntu1.4UNKNOWN
ubuntu10.10noarchpython-django< 1.2.3-1ubuntu0.2.10.10.3UNKNOWN
ubuntu11.04noarchpython-django< 1.2.5-1ubuntu1.1UNKNOWN
ubuntu11.10noarchpython-django< 1.3-2ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	python-django	< 1.1.1-2ubuntu1.4	UNKNOWN
ubuntu	10.10	noarch	python-django	< 1.2.3-1ubuntu0.2.10.10.3	UNKNOWN
ubuntu	11.04	noarch	python-django	< 1.2.5-1ubuntu1.1	UNKNOWN
ubuntu	11.10	noarch	python-django	< 1.3-2ubuntu1.1	UNKNOWN