id: PYSEC-2011-2
details: The verify_exists functionality in the URLField implementation in Django
  before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access
  to an arbitrary URL with no timeout, which allows remote attackers to cause a denial
  of service (resource consumption) via a URL associated with (1) a slow response,
  (2) a completed TCP connection with no application data sent, or (3) a large amount
  of application data, a related issue to CVE-2011-1521.
affected:
- package:
    name: django
    ecosystem: PyPI
    purl: pkg:pypi/django
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 1.2.7
    - introduced: '1.3'
    - fixed: 1.3.1
  versions:
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - '1.1'
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - '1.2'
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - '1.3'
references:
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=737366
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2011/sep/10/127/
- type: WEB
  url: http://openwall.com/lists/oss-security/2011/09/13/2
- type: WEB
  url: http://openwall.com/lists/oss-security/2011/09/15/5
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2011/sep/09/
- type: WEB
  url: http://openwall.com/lists/oss-security/2011/09/11/1
- type: ADVISORY
  url: http://secunia.com/advisories/46614
- type: ADVISORY
  url: http://www.debian.org/security/2011/dsa-2332
- type: WEB
  url: https://hermes.opensuse.org/messages/14700881
- type: ADVISORY
  url: https://github.com/advisories/GHSA-3jqw-crqj-w8qw
aliases:
- CVE-2011-4137
- GHSA-3jqw-crqj-w8qw
modified: '2021-07-05T00:01:17.875375Z'
published: '2011-10-19T10:55:00Z'