Is CVE-2010-4535 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2010-4535 being exploited in the wild.

How severe is CVE-2010-4535?

High severity, with a CVSS score of 7.5, published 23 July 2018.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.3, ECOSYSTEM:introduced=0,fixed=1.1.3,introduced=1.2,fixed=1.2.4, ECOSYSTEM:introduced=0,fixed=1.1.3|ECOSYSTEM:introduced=1.2,fixed=1.2.4.

Is there a fix for CVE-2010-4535?

Yes. Django (PyPI): upgrade to 1.1.3, 1.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2010-4535 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2010-4535?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2010-4535: Django denial of service in password reset timestamp handling

CVE-2010-4535 · Severity: high · CVSS 7.5 · Published 2018-07-23

A vulnerability in the Django web framework's password reset system could allow an attacker to crash the application. By sending a specially crafted web request with an extremely long timestamp, an attacker can force the server to consume excessive system resources. This can lead to a denial of service, making the website unavailable to legitimate users.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2010-4535 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2010-4535 being exploited in the wild.
How severe is CVE-2010-4535?: High severity, with a CVSS score of 7.5, published 23 July 2018.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.3, ECOSYSTEM:introduced=0,fixed=1.1.3,introduced=1.2,fixed=1.2.4, ECOSYSTEM:introduced=0,fixed=1.1.3|ECOSYSTEM:introduced=1.2,fixed=1.2.4.
Is there a fix for CVE-2010-4535?: Yes. Django (PyPI): upgrade to 1.1.3, 1.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2010-4535 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2010-4535?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 1.1.3, 1.2.4 or later
```
pip install "Django>=1.2.4"
```

Technical details

The vulnerability exists within the 'django.contrib.auth' component of the Django web framework. Specifically, the password reset mechanism does not perform length validation on the string representing a base36 timestamp provided in the reset URL. A remote, unauthenticated attacker can exploit this by submitting a URL containing an arbitrarily large base36 integer, leading to excessive CPU and memory consumption during processing. This resource exhaustion results in a denial of service (DoS) condition. The issue is resolved in Django versions 1.1.3, 1.2.4, and 1.3 beta 1.

Affected products

Django Project Django < 1.1.3, >= 1.2, < 1.2.4, 1.3 beta 1

Identifiers

CVE-2010-4535
GHSA-7wph-fc4w-wqp2
PYSEC-2011-29
PYSEC-2011-9

Timeline

2010-12-22: advisory: Django security release announcement
2011-01-10: disclosed: NVD publication date
2018-07-23: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.