GHSA-59w8-4wm2-4xw8

Suggest an improvement
Source
https://github.com/advisories/GHSA-59w8-4wm2-4xw8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-59w8-4wm2-4xw8/GHSA-59w8-4wm2-4xw8.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-59w8-4wm2-4xw8
Aliases
Published
2022-05-17T05:12:01Z
Modified
2024-09-17T15:24:09.243016Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Django Image Field Vulnerable to Image Decompression Bombs
Details

The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.

Database specific
{
    "nvd_published_at": "2012-07-31T17:55:00Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-29T22:31:03Z"
}
References

Affected packages

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2

Affected versions

1.*

1.0.1
1.0.2
1.0.3
1.0.4
1.1
1.1.1
1.1.2
1.1.3
1.1.4
1.2
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.3
1.3.1

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.4
Fixed
1.4.1

Affected versions

1.*

1.4