Bug 1179679 (CVE-2015-0221) - CVE-2015-0221 Django: denial of service attack against django.views.static.serve
Summary: CVE-2015-0221 Django: denial of service attack against django.views.static.serve
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2015-0221
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1181946 1181947 1181948 1181949
Blocks: 1179508
TreeView+ depends on / blocked
 
Reported: 2015-01-07 10:26 UTC by Martin Prpič
Modified: 2023-05-12 06:39 UTC (History)
22 users (show)

Fixed In Version: Django 1.7.3, Django 1.6.10, Django 1.4.18
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-06-14 10:38:51 UTC
Embargoed:

Attachments (Terms of Use)
serve-1.4.x.patch (11.30 KB, text/plain)
2015-01-07 10:28 UTC, Martin Prpič 		no flags Details
serve-1.6.x.patch (10.83 KB, text/plain)
2015-01-07 10:28 UTC, Martin Prpič 		no flags Details
serve-1.7.x.patch (11.92 KB, text/plain)
2015-01-07 10:28 UTC, Martin Prpič 		no flags Details
serve-master.patch (10.87 KB, text/plain)
2015-01-07 10:28 UTC, Martin Prpič 		no flags Details
View All

Description Martin Prpič 2015-01-07 10:26:45 UTC 
The Django project reports the following issue:

"""
In older versions of Django, the ``django.views.static.serve()`` view read the files it served one line at a time. Therefore, a big file with no newlines would result in memory usage equal to the size of that file. An attacker could exploit this and launch a denial-of-service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage.

Note, however, that this view has always carried a warning that it is not hardened for production use and should be used only as a development aid. Now may be a good time to audit your project and serve your files in production using a real front-end web server if you are not doing so.
"""

This issue is resolved in the upstream versions 1.7.3, 1.6.10, and 1.4.18. Note that Django 1.5 is no longer receiving security updates.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue.
Comment 1 Martin Prpič 2015-01-07 10:28:25 UTC 
Created attachment 977194 [details]
serve-1.4.x.patch
Comment 2 Martin Prpič 2015-01-07 10:28:28 UTC 
Created attachment 977196 [details]
serve-1.6.x.patch
Comment 3 Martin Prpič 2015-01-07 10:28:30 UTC 
Created attachment 977197 [details]
serve-1.7.x.patch
Comment 4 Martin Prpič 2015-01-07 10:28:33 UTC 
Created attachment 977198 [details]
serve-master.patch
Comment 5 Martin Prpič 2015-01-14 07:27:39 UTC 
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1181949]
Comment 6 Martin Prpič 2015-01-14 07:27:44 UTC 
Created python-django14 tracking bugs for this issue:

Affects: fedora-20 [bug 1181947]
Comment 7 Martin Prpič 2015-01-14 07:27:48 UTC 
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 1181946]
Affects: epel-7 [bug 1181948]
Comment 8 Martin Prpič 2015-01-14 07:29:54 UTC 
External References:

https://www.djangoproject.com/weblog/2015/jan/13/security/
Comment 9 Fedora Update System 2015-01-26 02:32:26 UTC 
python-django-1.6.10-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2015-01-27 03:00:21 UTC 
python-django14-1.4.18-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2015-01-27 03:05:54 UTC 
python-django-1.6.10-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2015-02-03 19:32:16 UTC 
Django14-1.4.18-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2015-02-05 19:01:48 UTC 
python-django-1.6.10-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Matthias Runge 2016-06-14 10:38:51 UTC 
all related bzs have been closed already.
Note You need to log in before you can comment on or make changes to this bug.