Vulnerability advisory

PYSEC-2012-3

Published Jul 31, 2012Updated Jun 10, 2026OSV record ↗

Also known as CVE-2012-3443GHSA-59w8-4wm2-4xw8

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
All versions before 1.3.2	`1.3.2`Advisories →
`1.4` to before 1.4.1	`1.4.1`Advisories →
Also listed as affected (20) `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1` `1.1.1` `1.1.2` `1.1.3` `1.1.4` `1.2` `1.2.1` `1.2.2` `1.2.3` `1.2.4` `1.2.5` `1.2.6` `1.2.7` `1.3` `1.3.1` `1.4`

Description

The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.

References

Webwww.openwall.com/lists/oss-security/2012/07/31/2 ↗
Webwww.openwall.com/lists/oss-security/2012/07/31/1 ↗
ARTICLEwww.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ ↗
Advisorywww.ubuntu.com/usn/USN-1560-1 ↗
Advisorywww.debian.org/security/2012/dsa-2529 ↗
Advisorywww.mandriva.com/security/advisories?name=MDVSA-2012:143 ↗
Advisorygithub.com/advisories/GHSA-59w8-4wm2-4xw8 ↗