CVE-2012-3443: Input Validation
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
Other sources
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3443?
CVE-2012-3443 has a medium severity rating as it can lead to denial of service by consuming memory through malicious image uploads.
How do I fix CVE-2012-3443?
To fix CVE-2012-3443, upgrade to Django version 1.3.2 or 1.4.1 or later.
Which versions of Django are affected by CVE-2012-3443?
CVE-2012-3443 affects Django versions prior to 1.3.2 and 1.4.x before 1.4.1.
What type of attack does CVE-2012-3443 facilitate?
CVE-2012-3443 facilitates denial of service attacks by allowing remote attackers to upload large image files.
Is there a specific workaround for CVE-2012-3443?
There is no specific workaround; updating to a patched version is the recommended solution for CVE-2012-3443.