Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2013-1443 python-django: DoS via large passwords|
|Product:||[Other] Security Response||Reporter:||Ratul Gupta <ratulg>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED WONTFIX||QA Contact:|
|Version:||unspecified||CC:||aortega, apevec, athomas, ayoung, bkabrda, bkearney, chrisw, gkotton, gmollett, iheim, jpichon, katello-bugs, lhh, markmc, mhroncok, michel, mrunge, rbryant, rhos-maint, sclewis, yeylon|
|Fixed In Version:||Django 1.4.8, Django 1.5.4||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2014-11-14 12:50:46 EST||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||1008281, 1008282, 1009258|
Description Ratul Gupta 2013-09-16 01:02:55 EDT
It was found that python-django, a high level Python web framework, was vulnerable to a DoS attack via large passwords, where an attacker could send a large password to the machine, as there wasn't any limit imposed on the length of passwords, a large password could use all the machine's available resources for the hash computation, thus making the machine slow and unresponsive. The issue has been known to be fixed in latest updates for python-django 1.4.8 and 1.5.4. References: https://www.djangoproject.com/weblog/2013/sep/15/security/ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=723043
Comment 1 Ratul Gupta 2013-09-16 01:12:57 EDT
Created Django14 tracking bugs for this issue: Affects: epel-6 [bug 1008282]
Comment 2 Ratul Gupta 2013-09-16 01:13:19 EDT
Created python-django tracking bugs for this issue: Affects: fedora-all [bug 1008281]
Comment 3 Lon Hohberger 2013-09-17 10:27:52 EDT
This needs clones for openstack-3 and openstack-rdo...
Comment 4 Garth Mollett 2013-09-18 00:27:38 EDT
(In reply to Lon Hohberger from comment #3) > This needs clones for openstack-3 and openstack-rdo... Lon, I've just triaged this for openstack and I belive we are not affected as keystone imposes a 4k limit on passwords. Unless you think there is somewhere else this is exposed?
Comment 7 Fedora Update System 2013-09-24 18:56:17 EDT
python-django-1.5.4-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2013-09-24 19:04:52 EDT
python-django14-1.4.8-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2013-10-01 13:35:25 EDT
Django14-1.4.8-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 10 Lon Hohberger 2013-10-04 13:43:20 EDT
Ok, Garth - I wasn't certain; it just looked like we were affected based on versioning. Thanks!