CVE-2011-4137: Denial of service in django
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.81652%
CWE
Published
7/23/2018
Updated
9/16/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 0, < 1.2.7 | 1.2.7 |
| Django | pip | >= 1.3, < 1.3.1 | 1.3.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from two key components:
- URLValidator's call method implemented the verify_exists check using Python's urllib2 without timeouts or proper connection management. The commit diff shows this method originally used urllib2.urlopen directly and handled redirects unsafely.
- URLField's init method enabled verify_exists by default, making applications vulnerable unless explicitly disabled. The patch changed this default to False. The combination of these two functions created the vulnerable path where user-controlled URLs could trigger unconstrained network requests, matching the CWE-1088 description of synchronous remote resource access without timeout.