Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1
    allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email
    address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
    (CVE-2009-3695)

The forms library of python-django, a high-level Python web development framework, is using a badly chosen regular expression when validating email addresses and URLs. An attacker can use this to perform denial of service attacks (100% CPU consumption) due to bad backtracking via a specially crafted email address or URL which is validated by the django forms library.

python-django in the oldstable distribution (etch), is not affected by this problem.

Django project reports :

Django's forms library includes field types which perform regular-expression-based validation of email addresses and URLs.
Certain addresses/URLs could trigger a pathological performance case in these regular expression, resulting in the server process/thread becoming unresponsive, and consuming excessive CPU over an extended period of time. If deliberately triggered, this could result in an effectively denial-of-service attack.

Multiple vulnerabilities has been found and corrected in python-django :

The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected static media files, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL (CVE-2009-2659).

Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression (CVE-2009-3695).

The versions of Django shipping with Mandriva Linux have been updated to the latest patched version that include the fix for this issue. In addition, they provide other bug fixes.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

ID	Name	Product	Family	Severity
432332	SCA: security update for Django (GHSA-p6m5-h7pp-v2x5)	Tenable Cloud Security	SCA Checks	high
432332	SCA: security update for Django (GHSA-p6m5-h7pp-v2x5)	Tenable Self-Hosted Container Security	SCA Checks	high
44770	Debian DSA-1905-1 : python-django - insufficient input validation	Nessus	Debian Local Security Checks	medium
42170	FreeBSD : django -- denial-of-service attack (87917d6f-ba76-11de-bac2-001a4d563a0f)	Nessus	FreeBSD Local Security Checks	medium
42131	Mandriva Linux Security Advisory : python-django (MDVSA-2009:276-1)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2009-3695

high

Tenable Plugins

high

high

medium

medium

medium