Severity
Severity not reported.
Affected versions
No affected versions listed.
Description
The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.
References
- Advisoryadvisories.mageia.org/MGASA-2015-0026.html ↗
- Advisorysecunia.com/advisories/62285 ↗
- Advisorysecunia.com/advisories/62309 ↗
- Advisorysecunia.com/advisories/62718 ↗
- Advisoryubuntu.com/usn/usn-2469-1 ↗
- Advisorywww.mandriva.com/security/advisories?name=MDVSA-2015:036 ↗
- Advisorywww.mandriva.com/security/advisories?name=MDVSA-2015:109 ↗
- Advisorywww.djangoproject.com/weblog/2015/jan/13/security/ ↗
- EVIDENCEwww.djangoproject.com/weblog/2015/jan/13/security/ ↗
- Fixubuntu.com/usn/usn-2469-1 ↗
- Fixwww.djangoproject.com/weblog/2015/jan/13/security/ ↗
- Weblists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html ↗
- Weblists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html ↗
- Weblists.fedoraproject.org/pipermail/package-announce/2015-January/148696.html ↗
- Weblists.opensuse.org/opensuse-updates/2015-04/msg00001.html ↗
- Weblists.opensuse.org/opensuse-updates/2015-09/msg00035.html ↗