CVE-2013-0306
CVE-2013-0306
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.
CVSS 5.3 · Medium · EPSS 2.6% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
python-django Debian:12
- Affected ranges
- ECOSYSTEM: < 1.4.4-1
Update to 1.4.4-1
python-django Debian:13
- Affected ranges
- ECOSYSTEM: < 1.4.4-1
Update to 1.4.4-1
python-django Debian:14
- Affected ranges
- ECOSYSTEM: < 1.4.4-1
Update to 1.4.4-1
django PyPI
- Versions
- 1.3
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.3.5
- Affected ranges
- ECOSYSTEM: ≥ 1.3, < 1.3.6
Update to 1.3.6
django PyPI
- Versions
- 1.4
- 1.4.1
- 1.4.2
- 1.4.3
- Affected ranges
- ECOSYSTEM: ≥ 1.4, < 1.4.4
Update to 1.4.4
django PyPI
- Versions
- 1.3
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.3.5
- 1.4
- 1.4.1
- 1.4.2
- 1.4.3
- Affected ranges
- ECOSYSTEM: ≥ 1.3, < 1.3.6 ∪ ≥ 1.4, < 1.4.4
Update to 1.3.6; Update to 1.4.4