Urgent Django security updates released

[Posted October 10, 2009 by corbet]

The Django project has announced the release of a set of urgent security updates. "This issue was disclosed publicly by a third party on a high-traffic mailing list, and attempts have been made to exploit it against live Django installations; as such, we are bypassing our normal policy for security disclosure and immediately issuing patches and updated releases." The vulnerability (a denial of service problem) affects any Django application running 1.0 or later and using the EmailField or URLField features.

(Log in to post comments)

Posted Oct 11, 2009 0:54 UTC (Sun) by csamuel (✭ supporter ✭, #2624) [Link]

According to the alert this is a potential DoS attack in that the exploit
causes a regular expression to consume lots of CPU.