~ / search / GHSA-6g95-x6cj-mg4v

GHSA-6g95-x6cj-mg4v

Django database denial-of-service with ModelMultipleChoiceField

Source: GitHub Advisory Database (reviewed) High CVE-2015-0222

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 1.6, < 1.6.10 1.6.10
PyPI Django >= 1.7, < 1.7.3 1.7.3

Details

As written in the advisory (Markdown source, shown as plain text).

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.

References

External links from the advisory. They lead to third-party sites.