Django 'EmailField' and 'URLField' Remote Denial of Service Vulnerability

Bugtraq ID:	36655
Class:	Design Error
CVE:	CVE-2009-3695
Remote:	Yes
Local:	No
Published:	Oct 09 2009 12:00AM
Updated:	Dec 10 2009 11:34PM
Credit:	davisd
Vulnerable:	Red Hat Fedora 11 Red Hat Fedora 10 Pardus Linux 2009 0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Django Django 1.1 Django Django 1.0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha
Not Vulnerable:	Django Django 1.1.1 Django Django 1.0.4

Django 'EmailField' and 'URLField' Remote Denial of Service Vulnerability

Django is prone to a denial-of-service vulnerability when processing email addresses and URLs.

Exploiting this issue allows remote attackers to consume excessive CPU over an extended period of time, causing denial-of-service conditions.

Django 1.0 and 1.1 are affected.

Django 'EmailField' and 'URLField' Remote Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Django 'EmailField' and 'URLField' Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 hppa

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Debian Linux 5.0 ia-64

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Djangoproject Django 1.0

• Django Django-1.0.4.tar.gz
  http://www.djangoproject.com/download/1.0.4/tarball/

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva python-django-1.0.4-0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 m68k

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Debian Linux 5.0 arm

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Mandriva Linux Mandrake 2009.0

• Mandriva python-django-1.0.4-0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/

Djangoproject Django 1.1

• Django Django-1.1.tar.gz
  http://www.djangoproject.com/download/1.1.1/tarball/

Debian Linux 5.0 armel

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva python-django-1.0.4-0.1mdvmes5.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 alpha

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Debian Linux 5.0 amd64

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva python-django-1.0.4-0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 ia-32

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva python-django-1.0.4-0.1mdv2008.0.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mips

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

MandrakeSoft Enterprise Server 5

• Mandriva python-django-1.0.4-0.1mdvmes5.noarch.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

• Mandriva python-django-1.0.4-0.1mdv2008.0.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 s/390

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Debian Linux 5.0 mipsel

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Mandriva Linux Mandrake 2009.1

• Mandriva python-django-1.0.4-0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 powerpc

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Debian Linux 5.0 sparc

• Debian python-django_1.0.2-1+lenny2_all.deb
  http://security.debian.org/pool/updates/main/p/python-django/python-dj ango_1.0.2-1+lenny2_all.deb

Django 'EmailField' and 'URLField' Remote Denial of Service Vulnerability

References:

• Django Homepage (Django)
  
• Remote denial of service via pathological performance of regular expressions (Debian)
  
• Security updates released (Django)