CVE-2009-3695 - Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before

CVE-2009-3695

Summary

Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.

References

Vulnerable Configurations

cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 17-08-2017 - 01:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

refmap via4

bid	36655
confirm	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550457 http://www.djangoproject.com/weblog/2009/oct/09/security/
debian	DSA-1905
misc	http://groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51/
mlist	[oss-security] 20091013 Re: Duplicate CVE assignment notification [was: CVE id request: django]
secunia	36948 36968
vupen	ADV-2009-2871
xf	django-emailfield-urlfield-dos(53727)

Last major update

17-08-2017 - 01:31

Published

13-10-2009 - 10:30

Last modified

17-08-2017 - 01:31