The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other
    products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote
    attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-
    Language headers. (CVE-2007-5712)

Simon Willison discovered that in Django, a Python web framework, the feature to retain HTTP POST data during user reauthentication allowed a remote attacker to perform unauthorized modification of data through cross site request forgery. This is possible regardless of the Django plugin to prevent cross site request forgery being enabled. The Common Vulnerabilities and Exposures project identifies this issue as CVE-2008-3909.

In this update the affected feature is disabled; this is in accordance with upstream's preferred solution for this situation.

This update takes the opportunity to also include a relatively minor denial of service attack in the internationalisation framework, known as CVE-2007-5712.

- Thu Nov 1 2007 Michel Salim <michel.sylvan at gmail.com>     0.96.1-1

    - i18n security update: CVE-2007-5712, bz#357051

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #362771 - CVE-2007-5712 Django 0.96 i18n DoS [F8]

  - Bug #357051 - CVE-2007-5712 Django 0.96 i18n DoS

  - CVE-2007-5712

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
432535	SCA: security update for Django (GHSA-9v8h-57gv-qch6)	Tenable Cloud Security	SCA Checks	high
432535	SCA: security update for Django (GHSA-9v8h-57gv-qch6)	Tenable Self-Hosted Container Security	SCA Checks	high
34253	Debian DSA-1640-1 : python-django - several vulnerabilities	Nessus	Debian Local Security Checks	medium
28164	Fedora 7 : Django-0.96.1-1.fc7 (2007-3157)	Nessus	Fedora Local Security Checks	low
28152	Fedora 8 : Django-0.96.1-1.fc8 (2007-2788)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2007-5712

high

Tenable Plugins

high

high

medium

low

low