Description
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.
References (6)
Core 6
Core References
Patch, Vendor Advisory x_refsource_confirm
https://www.djangoproject.com/weblog/2014/aug/20/security/
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/61276
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/61281
Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2014/dsa-3010
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59782
Scores
EPSS
0.0245
EPSS Percentile
82.5%
Details
CWE
CWE-399
Status
published
Products (33)
debian/debian_linux
7.0
djangoproject/django
1.4
djangoproject/django
1.4.1
djangoproject/django
1.4.2
djangoproject/django
1.4.4
djangoproject/django
1.4.5
djangoproject/django
1.4.6
djangoproject/django
1.4.7
djangoproject/django
1.4.8
djangoproject/django
1.4.9
... and 23 more
Published
Aug 26, 2014
Tracked Since
Feb 18, 2026