CVE-2014-0481
Fixed in a distro release EPSS 2%
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.
Products: opensuse, opensuse_project opensuse, djangoproject django, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 1.4.14 |
| PyPI | django | 1.5.9 |
| PyPI | django | 1.6.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-django | 1.6.6-1 |
| Debian 13 | python-django | 1.6.6-1 |
| Debian 14 | python-django | 1.6.6-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze11 |
| Debian 7 | python-django | 1.4.5-1+deb7u8 |
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.4 |