CVE-2013-1443: Django Denial of Service Vulnerability in… – CVSS 5.0 · Watchpost

← All vulnerabilities

Django Denial of Service Vulnerability in the authentication framework

MEDIUM 5.0CVE-2013-1443 · GHSA-4c42-4rxm-x6qf · PYSEC-2013-18 · Published 23/09/2013 · updated 16/06/2026

In short

CVE-2013-1443 is a MEDIUM (CVSS 5.0) vulnerability affecting django, django (djangoproject).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.8% of all vulnerabilities.
Fix: update to 1.4.8, 1.5.4 or later.

Package	Affected versions	Patched versions
django PyPI	`≥ 1.4, < 1.4.8≥ 1.5, < 1.5.4`	`1.4.81.5.4`
django djangoproject	`= 1.4= 1.4.1= 1.4.2= 1.4.4= 1.4.5= 1.4.6= 1.4.7= 1.5= 1.5.1= 1.5.2= 1.5.3= 1.6`	No fix yet

Description

The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.

NVD description

The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.

References

nvd.nist.gov/vuln/detail/CVE-2013-1443 · ADVISORY
django/django commit 22b74fa · WEB
django/django commit 3f3d887 · WEB
django/django · PACKAGE
pypa/advisory-database · WEB
djangoproject.com/weblog/2013/sep/15/security · WEB
lists.opensuse.org/opensuse-updates/2013-10/msg00015.html · WEB
lists.opensuse.org/opensuse-updates/2013-11/msg00035.html · WEB
python.6.x6.nabble.com/Set-a-reasonable-upper-bound-on-password-length-td5032218.html · WEB
debian.org/security/2013/dsa-2758 · WEB
djangoproject.com/weblog/2013/sep/15/security · Patch

More vulnerabilities in django

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free