CVE-2013-1443

Advisory

The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1443
• http://www.debian.org/security/2013/dsa-2758
• https://www.djangoproject.com/weblog/2013/sep/15/security/
• http://python.6.x6.nabble.com/Set-a-reasonable-upper-bound-on-password-length-td5032218.html
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00035.html