Denial of Service Vulnerability in Django's Static File Serving - CVE-2015-0221
Summary
CVE-2015-0221: The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption... Affects python-django versions < 1.7.1-1.1. Fixed in 1.7.1-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, and templating. However, certain versions of Django are vulnerable to a denial of service attack through the 'django.views.static.serve' view, which can lead to excessive memory consumption when processing files with long lines.
Vulnerability Detail
The vulnerability identified as CVE-2015-0221 affects Django versions prior to 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3. The issue arises from the way the 'serve' view reads files, processing them line by line. An attacker can exploit this by uploading a file containing excessively long lines, which can cause the server to consume a significant amount of memory, potentially leading to a denial of service. This vulnerability poses a risk to applications that rely on Django's static file serving capabilities, especially in environments where untrusted users can upload files.
How To Fix
Minimum fixed version
1.7.1-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider disabling the 'django.views.static.serve' view in production environments. Instead, serve static files using a dedicated web server like Nginx or Apache, which is designed to handle such requests more efficiently.
Conclusion
CVE-2015-0221 is a significant vulnerability in certain versions of Django that can lead to denial of service through memory exhaustion. It is crucial for developers to upgrade to a secure version of Django and consider alternative methods for serving static files to mitigate this risk.
See every vulnerability recorded for python-django →
FAQ
CVE-2015-0221 is a vulnerability in Django's static file serving mechanism that can lead to denial of service due to excessive memory consumption.
Django versions before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploiting this vulnerability can lead to denial of service, where the application becomes unresponsive due to high memory usage.
As a temporary measure, disable the 'django.views.static.serve' view and serve static files using a dedicated web server like Nginx or Apache.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
