CVE-2014-0481: High severity opensuse vulnerability
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0481?
CVE-2014-0481 has a medium severity rating due to its potential to allow unauthorized file uploads through name conflicts.
How do I fix CVE-2014-0481?
To fix CVE-2014-0481, upgrade Django to versions 1.5.9, 1.6.6, or 1.4.14 and later.
What versions of Django are affected by CVE-2014-0481?
CVE-2014-0481 affects Django versions before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3.
Who is affected by CVE-2014-0481?
Users of affected versions of Django who implement file upload features are vulnerable to CVE-2014-0481.
Is there a workaround for CVE-2014-0481?
No official workarounds have been provided for CVE-2014-0481, and upgrading is strongly recommended.