Red Hat Bugzilla – Bug 1129952
CVE-2014-0481 Django: file upload denial of service
Last modified: 2016-04-26 15:28:34 EDT
The Django project reports the following issue: "" In the default configuration, when Django's file upload handling system is presented with a file that would have the same on-disk path and name as an existing file, attempts to generate a new unique filename by appending an underscore and an integer to the end of the (as stored on disk) filename, incrementing the integer (i.e., ``_1``, ``_2``, etc.) until it has generated a name which does not conflict with any existing file. An attacker with knowledge of this can exploit the sequential behavior of filename generation by uploading many tiny files which all share a filename; Django will, in processing them, generate ever-increasing numbers of ``os.stat()`` calls as it attempts to generate a unique filename. As a result, even a relatively small number of such uploads can significantly degrade performance. To remedy this, Django's file-upload system will no longer use sequential integer names to avoid filename conflicts on disk; instead, a short random alphanumeric string will be appended, removing the ability to reliably generate many repeatedly-conflicting filenames. "" This issue is due to be resolved in the upstream 1.4.14, 1.5.9, 1.6.6, and 1.7 release candidate 3 releases. Acknowledgements: Red Hat would like to thank the upstream Django project for reporting this issue. Upstream acknowledges David Wilson as the original reporter.
Created attachment 926638 [details] 1.4 patch
Created attachment 926639 [details] 1.5 patch
Created attachment 926640 [details] 1.6 patch
External References: https://www.djangoproject.com/weblog/2014/aug/20/security/
Created Django14 tracking bugs for this issue: Affects: epel-6 [bug 1132776]
Created python-django15 tracking bugs for this issue: Affects: fedora-20 [bug 1132775] Affects: epel-6 [bug 1132777] Affects: epel-7 [bug 1132778]
Created python-django14 tracking bugs for this issue: Affects: fedora-all [bug 1132774]
Created python-django tracking bugs for this issue: Affects: fedora-all [bug 1132773]
python-django-1.5.9-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
python-django-1.6.6-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
python-django14-1.4.14-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
python-django15-1.5.9-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Django14-1.4.14-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
python-django14-1.4.16-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
python-django14-1.4.16-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.