Bug 1008279 (CVE-2013-1443)

Summary: CVE-2013-1443 python-django: DoS via large passwords
Product: [Other] Security Response Reporter: Ratul Gupta <ratulg>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aortega, apevec, athomas, ayoung, bkabrda, bkearney, chrisw, gkotton, gmollett, iheim, jpichon, katello-bugs, lhh, markmc, mhroncok, michel, mrunge, rbryant, rhos-maint, sclewis, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130915,reported=20130916,source=debian,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P,fedora-all/python-django=affected,epel-6/Django14=affected,openstack-3/Django14=notaffected,openstack-rdo/Django14=notaffected,sam-1/Django=wontfix
Fixed In Version: Django 1.4.8, Django 1.5.4 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-11-14 12:50:46 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1008281, 1008282, 1009258    
Bug Blocks: 1008285    

Description Ratul Gupta 2013-09-16 01:02:55 EDT
It was found that python-django, a high level Python web framework, was vulnerable to a DoS attack via large passwords, where an attacker could send a large password to the machine, as there wasn't any limit imposed on the length of passwords, a large password could use all the machine's available resources for the hash computation, thus making the machine slow and unresponsive.

The issue has been known to be fixed in latest updates for python-django 1.4.8 and 1.5.4.

References:

https://www.djangoproject.com/weblog/2013/sep/15/security/
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=723043
Comment 1 Ratul Gupta 2013-09-16 01:12:57 EDT
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1008282]
Comment 2 Ratul Gupta 2013-09-16 01:13:19 EDT
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 1008281]
Comment 3 Lon Hohberger 2013-09-17 10:27:52 EDT
This needs clones for openstack-3 and openstack-rdo...
Comment 4 Garth Mollett 2013-09-18 00:27:38 EDT
(In reply to Lon Hohberger from comment #3)
> This needs clones for openstack-3 and openstack-rdo...

Lon, I've just triaged this for openstack and I belive we are not affected as keystone imposes a 4k limit on passwords.

Unless you think there is somewhere else this is exposed?
Comment 7 Fedora Update System 2013-09-24 18:56:17 EDT
python-django-1.5.4-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2013-09-24 19:04:52 EDT
python-django14-1.4.8-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2013-10-01 13:35:25 EDT
Django14-1.4.8-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Lon Hohberger 2013-10-04 13:43:20 EDT
Ok, Garth - I wasn't certain; it just looked like we were affected based on versioning.  Thanks!