CVE-2011-4137

Django < 1.2.7 and 1.3.x < 1.3.1 - Denial of Service via URLField verify_exists

Title source: llm
STIX 2.1

Description

The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.

References (9)

Core 9
Core References
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/09/15/5
Various Sources vendor-advisory x_refsource_suse
https://hermes.opensuse.org/messages/14700881
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2332
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/46614
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/09/11/1
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/09/13/2
Patch, Vendor Advisory x_refsource_confirm
https://www.djangoproject.com/weblog/2011/sep/09/

Scores

EPSS 0.0302
EPSS Percentile 86.1%

Details

CWE
CWE-399
Status published
Products (20)
djangoproject/django 0.91
djangoproject/django 0.95
djangoproject/django 0.95.1
djangoproject/django 0.96
djangoproject/django 1.0
djangoproject/django 1.0.1
djangoproject/django 1.0.2
djangoproject/django 1.1
djangoproject/django 1.1.0
djangoproject/django 1.1.2
... and 10 more
Published Oct 19, 2011
Tracked Since Feb 18, 2026