CVE-2014-0481

Description

The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.

How to fix CVE-2014-0481

To remediate CVE-2014-0481, upgrade the affected package to a fixed version below.

• —upgrade to 1.6.6-1 or later
• —upgrade to 1.4.14 or later
• —upgrade to 1.4.14 or later

Is CVE-2014-0481 being exploited?

Low — EPSS is 1.1%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 1.6.6-1
• from 0, < 1.4.14
• from 0, < 1.4.14, >= 1.5, < 1.5.9, >= 1.6, < 1.6.6

CVSS scores

References (15)

• ADVISORYsecunia.com/advisories/59782
• ADVISORYsecunia.com/advisories/61276
• ADVISORYsecunia.com/advisories/61281
• ADVISORYgithub.com/advisories/GHSA-296w-6qhq-gf92
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-0481