CVE-2009-3695

Advisory

Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3695
• http://www.securityfocus.com/bid/36655
• http://groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51/
• http://secunia.com/advisories/36948
• http://www.debian.org/security/2009/dsa-1905
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550457
• http://www.vupen.com/english/advisories/2009/2871
• http://www.djangoproject.com/weblog/2009/oct/09/security/
• http://secunia.com/advisories/36968
• http://www.openwall.com/lists/oss-security/2009/10/13/6
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53727