Bug 1179679 (CVE-2015-0221)

Summary: CVE-2015-0221 Django: denial of service attack against django.views.static.serve
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, bkearney, carnil, cbillett, chrisw, dallan, gkotton, gmollett, jrusnack, kseifried, lhh, lpeer, markmc, mrunge, rbryant, sclewis, security-response-team, srevivo, tomckay
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Django 1.7.3, Django 1.6.10, Django 1.4.18 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-06-14 10:38:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1181946, 1181947, 1181948, 1181949    
Bug Blocks: 1179508    
Attachments:
Description Flags
serve-1.4.x.patch
none
serve-1.6.x.patch
none
serve-1.7.x.patch
none
serve-master.patch none

Description Martin Prpič 2015-01-07 10:26:45 UTC 
The Django project reports the following issue:

"""
In older versions of Django, the ``django.views.static.serve()`` view read the files it served one line at a time. Therefore, a big file with no newlines would result in memory usage equal to the size of that file. An attacker could exploit this and launch a denial-of-service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage.

Note, however, that this view has always carried a warning that it is not hardened for production use and should be used only as a development aid. Now may be a good time to audit your project and serve your files in production using a real front-end web server if you are not doing so.
"""

This issue is resolved in the upstream versions 1.7.3, 1.6.10, and 1.4.18. Note that Django 1.5 is no longer receiving security updates.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue.
Comment 1 Martin Prpič 2015-01-07 10:28:25 UTC 
Created attachment 977194 [details]
serve-1.4.x.patch
Comment 2 Martin Prpič 2015-01-07 10:28:28 UTC 
Created attachment 977196 [details]
serve-1.6.x.patch
Comment 3 Martin Prpič 2015-01-07 10:28:30 UTC 
Created attachment 977197 [details]
serve-1.7.x.patch
Comment 4 Martin Prpič 2015-01-07 10:28:33 UTC 
Created attachment 977198 [details]
serve-master.patch
Comment 5 Martin Prpič 2015-01-14 07:27:39 UTC 
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1181949]
Comment 6 Martin Prpič 2015-01-14 07:27:44 UTC 
Created python-django14 tracking bugs for this issue:

Affects: fedora-20 [bug 1181947]
Comment 7 Martin Prpič 2015-01-14 07:27:48 UTC 
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 1181946]
Affects: epel-7 [bug 1181948]
Comment 8 Martin Prpič 2015-01-14 07:29:54 UTC 
External References:

https://www.djangoproject.com/weblog/2015/jan/13/security/
Comment 9 Fedora Update System 2015-01-26 02:32:26 UTC 
python-django-1.6.10-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2015-01-27 03:00:21 UTC 
python-django14-1.4.18-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2015-01-27 03:05:54 UTC 
python-django-1.6.10-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2015-02-03 19:32:16 UTC 
Django14-1.4.18-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2015-02-05 19:01:48 UTC 
python-django-1.6.10-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Matthias Runge 2016-06-14 10:38:51 UTC 
all related bzs have been closed already.