Bug 1129952 (CVE-2014-0481)

Summary: CVE-2014-0481 Django: file upload denial of service
Product: [Other] Security Response Reporter: Murray McAllister <mmcallis>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, bkearney, carnil, cbillett, chrisw, dallan, gkotton, jrusnack, kseifried, lhh, lpeer, markmc, mrunge, rbryant, sclewis, security-response-team, tjay, tomckay, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: django 1.4.14, django 1.5.9, django 1.6.6, django 1.7-rc3 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-26 23:40:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1132773, 1132774, 1132775, 1132776, 1132777, 1132778    
Bug Blocks: 1129960    
Attachments:
Description Flags
1.4 patch
none
1.5 patch
none
1.6 patch none

Description Murray McAllister 2014-08-14 04:44:17 UTC 
The Django project reports the following issue:

""
In the default configuration, when Django's file upload handling
system is presented with a file that would have the same on-disk path
and name as an existing file, attempts to generate a new unique
filename by appending an underscore and an integer to the end of the
(as stored on disk) filename, incrementing the integer (i.e., ``_1``,
``_2``, etc.) until it has generated a name which does not conflict
with any existing file.

An attacker with knowledge of this can exploit the sequential behavior
of filename generation by uploading many tiny files which all share a
filename; Django will, in processing them, generate ever-increasing
numbers of ``os.stat()`` calls as it attempts to generate a unique
filename. As a result, even a relatively small number of such uploads
can significantly degrade performance.

To remedy this, Django's file-upload system will no longer use
sequential integer names to avoid filename conflicts on disk; instead,
a short random alphanumeric string will be appended, removing the
ability to reliably generate many repeatedly-conflicting filenames.
""

This issue is due to be resolved in the upstream 1.4.14, 1.5.9, 1.6.6, and 1.7 release candidate 3 releases.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue. Upstream acknowledges David Wilson as the original reporter.
Comment 2 Murray McAllister 2014-08-14 04:45:58 UTC 
Created attachment 926638 [details]
1.4 patch
Comment 3 Murray McAllister 2014-08-14 04:46:17 UTC 
Created attachment 926639 [details]
1.5 patch
Comment 4 Murray McAllister 2014-08-14 04:46:50 UTC 
Created attachment 926640 [details]
1.6 patch
Comment 5 Murray McAllister 2014-08-22 03:42:36 UTC 
External References:

https://www.djangoproject.com/weblog/2014/aug/20/security/
Comment 6 Murray McAllister 2014-08-22 03:52:44 UTC 
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1132776]
Comment 7 Murray McAllister 2014-08-22 03:52:48 UTC 
Created python-django15 tracking bugs for this issue:

Affects: fedora-20 [bug 1132775]
Affects: epel-6 [bug 1132777]
Affects: epel-7 [bug 1132778]
Comment 8 Murray McAllister 2014-08-22 03:52:52 UTC 
Created python-django14 tracking bugs for this issue:

Affects: fedora-all [bug 1132774]
Comment 9 Murray McAllister 2014-08-22 03:52:56 UTC 
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 1132773]
Comment 10 Fedora Update System 2014-09-09 22:18:58 UTC 
python-django-1.5.9-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2014-09-09 22:27:10 UTC 
python-django-1.6.6-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2014-09-09 22:27:30 UTC 
python-django14-1.4.14-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2014-09-10 13:29:43 UTC 
python-django15-1.5.9-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2014-09-24 03:45:58 UTC 
Django14-1.4.14-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 Fedora Update System 2014-12-01 18:58:38 UTC 
python-django14-1.4.16-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 16 Fedora Update System 2014-12-01 18:59:42 UTC 
python-django14-1.4.16-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.