Other nomination

James Bennett -- Django DOS

Chris Brook · Threatpost | The first stop for security news · 17 September 2013

Django hashed submitted passwords with no length cap, so repeatedly posting very large passwords tied servers up in PBKDF2 work - about a minute for a one-megabyte password. Releases 1.4.8, 1.5.4 and 1.6 beta 4 reject authentication above 4096 bytes (CVE-2013-1443). The flaw was disclosed publicly on the developers' mailing list, forcing an out-of-band release.

Record

Researcher

Chris Brook

Published by

Threatpost | The first stop for security news

Date

17 September 2013

In the archive

• Nominated for the 2013 Top 10 Web Hacking Techniques

Tags

• django
• python
• dos
• algorithmic-complexity
• cve
• vendor-advisory
• mitigation
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Chris Brook, first published at the original source. Preserved copies are kept so the citation survives its host.