Is CVE-2014-0481 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-0481 being exploited in the wild.

How severe is CVE-2014-0481?

Low severity, with a CVSS score of 3.1, published 26 August 2014.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.14, ECOSYSTEM:introduced=0,fixed=1.4.14,introduced=1.5,fixed=1.5.9,introduced=1.6,fixed=1.6.6.

Is there a fix for CVE-2014-0481?

Yes. Django (PyPI): upgrade to 1.4.14, 1.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2014-0481 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2014-0481?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-0481: Django denial of service via file upload naming

CVE-2014-0481 · Severity: low · CVSS 3.1 · Published 2014-08-26

Django is a popular web application framework used to build dynamic websites and APIs. When handling file uploads, Django's default configuration generates sequential file names for conflicting uploads using an inefficient algorithm. An attacker can exploit this by uploading many files with the same name, causing the server to consume excessive CPU resources and become unresponsive, disrupting service availability for legitimate users.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2014-0481 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-0481 being exploited in the wild.
How severe is CVE-2014-0481?: Low severity, with a CVSS score of 3.1, published 26 August 2014.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.14, ECOSYSTEM:introduced=0,fixed=1.4.14,introduced=1.5,fixed=1.5.9,introduced=1.6,fixed=1.6.6.
Is there a fix for CVE-2014-0481?: Yes. Django (PyPI): upgrade to 1.4.14, 1.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2014-0481 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2014-0481?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 1.4.14, 1.6.6 or later
```
pip install "Django>=1.6.6"
```

Technical details

The vulnerability exists in Django's file upload handler, which uses an O(n) sequential algorithm to generate unique file names when a file with a conflicting name is uploaded. An attacker can exploit this by uploading multiple files with identical names, causing the algorithm to iterate through increasingly larger numbers of existing files, leading to quadratic time complexity and CPU exhaustion. The vulnerability affects Django versions before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3. The attack requires network access to the upload endpoint and no authentication or user interaction. The fix involves replacing the O(n) algorithm with a more efficient naming strategy. Patches are available in the affected version branches.

Affected products

Django Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, 1.7 before RC3

Identifiers

CVE-2014-0481
GHSA-296w-6qhq-gf92
PYSEC-2014-5

Timeline

2014-08-20: disclosed
2014-08-20: patched

References

https://github.com/django/django/commit/26cd48e166ac4d84317c8ee6d63ac52a87e8da99

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.