Read the docs
TI-2012-02972 Aliases CVE-2012-3444GHSA-5h2q-4hrp-v9rr

The get_image_dimensions function in the image-handling functionality in Django before…

Priority LOW 26CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.

Summary

The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.

Why it matters now

EPSS 0.01774 78th percentileScored 2026-11-07
Fix Fixed Django (PyPI): 1.3.2, 1.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Django (PyPI)before 1.3.21.3.2Patch availableGHSA-5h2q-4hrp-v9rr
—Django (PyPI)1.4 to before 1.4.11.4.1Patch availableGHSA-5h2q-4hrp-v9rr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Django (PyPI) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-5h2q-4hrp-v9rr
  • Django (PyPI) Vendor— Affected 1.4 to before 1.4.1 Fixed in 1.4.1 Patch available GHSA-5h2q-4hrp-v9rr

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*up to 1.3Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:0.95:*:*:*:*:*:*:*0.95Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:0.96:*:*:*:*:*:*:*0.96Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*1.0Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.0:alpha1:*:*:*:*:*:*1.0 alpha1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.0:alpha2:*:*:*:*:*:*1.0 alpha2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.0:beta:*:*:*:*:*:*1.0 betaVulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.0:beta2:*:*:*:*:*:*1.0 beta2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.0.1:*:*:*:*:*:*:*1.0.1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.0.2:*:*:*:*:*:*:*1.0.2Vulnerabledjangoproject
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions up to 1.3 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:0.95:*:*:*:*:*:*:* Versions 0.95 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:0.96:*:*:*:*:*:*:* Versions 0.96 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.0:alpha1:*:*:*:*:*:* Versions 1.0 alpha1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.0:alpha2:*:*:*:*:*:* Versions 1.0 alpha2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.0:beta:*:*:*:*:*:* Versions 1.0 beta Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.0:beta2:*:*:*:*:*:* Versions 1.0 beta2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·djangoproject
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*1.1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.1:alpha1:*:*:*:*:*:*1.1 alpha1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.1:beta1:*:*:*:*:*:*1.1 beta1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.1:rc1:*:*:*:*:*:*1.1 rc1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:*1.1.2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*1.1.3Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.1.4:*:*:*:*:*:*:*1.1.4Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:*1.2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2:beta1:*:*:*:*:*:*1.2 beta1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2:rc1:*:*:*:*:*:*1.2 rc1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2-alpha1:*:*:*:*:*:*:*1.2-alpha1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:*1.2.2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:*1.2.4Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2.5:*:*:*:*:*:*:*1.2.5Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2.6:*:*:*:*:*:*:*1.2.6Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.2.7:*:*:*:*:*:*:*1.2.7Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:*1.3 alpha1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.3:beta1:*:*:*:*:*:*1.3 beta1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:*1.4Vulnerabledjangoproject
  • cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.1:alpha1:*:*:*:*:*:* Versions 1.1 alpha1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.1:beta1:*:*:*:*:*:* Versions 1.1 beta1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.1:rc1:*:*:*:*:*:* Versions 1.1 rc1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2:beta1:*:*:*:*:*:* Versions 1.2 beta1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2:rc1:*:*:*:*:*:* Versions 1.2 rc1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2-alpha1:*:*:*:*:*:*:* Versions 1.2-alpha1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.2.7:*:*:*:*:*:*:* Versions 1.2.7 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:* Versions 1.3 alpha1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.3:beta1:*:*:*:*:*:* Versions 1.3 beta1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·djangoproject

Remediation

  • Fix · GHSA-5h2q-4hrp-v9rr Django (PyPI) Fixed in 1.3.2 Advisory →
  • Fix · GHSA-5h2q-4hrp-v9rr Django (PyPI) Fixed in 1.4.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-3444
  2. 2026-10-03 Alias added: GHSA-5h2q-4hrp-v9rr

References

Patch 1

Advisory 4

Other 10

  • TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
  • TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
  • TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
  • TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
  • TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
  • TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
See all 156 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences