CVE-2015-0221

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.

Affected Software

Name	Vendor	Start Version	End Version
Django	Djangoproject	*	1.4.17 (including)
Django	Djangoproject	1.6 (including)	1.6 (including)
Django	Djangoproject	1.6.1 (including)	1.6.1 (including)
Django	Djangoproject	1.6.2 (including)	1.6.2 (including)
Django	Djangoproject	1.6.3 (including)	1.6.3 (including)
Django	Djangoproject	1.6.4 (including)	1.6.4 (including)
Django	Djangoproject	1.6.5 (including)	1.6.5 (including)
Django	Djangoproject	1.6.6 (including)	1.6.6 (including)
Django	Djangoproject	1.6.7 (including)	1.6.7 (including)
Django	Djangoproject	1.6.8 (including)	1.6.8 (including)
Django	Djangoproject	1.6.9 (including)	1.6.9 (including)
Django	Djangoproject	1.7 (including)	1.7 (including)
Django	Djangoproject	1.7.1 (including)	1.7.1 (including)
Django	Djangoproject	1.7.2 (including)	1.7.2 (including)
Python-django	Ubuntu	devel	*
Python-django	Ubuntu	esm-infra-legacy/trusty	*
Python-django	Ubuntu	lucid	*
Python-django	Ubuntu	precise	*
Python-django	Ubuntu	trusty	*
Python-django	Ubuntu	trusty/esm	*
Python-django	Ubuntu	upstream	*
Python-django	Ubuntu	utopic	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2015-0221
CWE	https://cwe.mitre.org/data/definitions/399.html

Affected Software

References