CVE-2013-1443

Django 1.4.x to 1.6.x auth framework CPU DoS via long password

• CVSS 5.0
• CWE-287 Improper Authentication
• Resource Management
• Remote

The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.

CVE

CVE-2013-1443

CWE

CWE-287 Improper Authentication

CVSS base score

5.0

Published

2013-09-23

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Django to version 1.4.8, 1.5.4, or 1.6 beta 4.

import hashlib

def hash_password(password):
    hashed_password = hashlib.sha256(password.encode()).hexdigest()
    return hashed_password

password = input("Enter your password: ")
hashed = hash_password(password)
print("Password hashed successfully.")

import hashlib
import time

def hash_password(password):
    max_length = 128
    if len(password) > max_length:
        raise ValueError("Password too long")

    hashed_password = hashlib.pbkdf2_hmac('sha256', password.encode(), b'salt', 100000)
    return hashed_password

try:
    password = input("Enter your password: ")
    hashed = hash_password(password)
    print("Password hashed successfully.")
except ValueError as e:
    print(e)

@misc{vaitp:cve20131443,
  title        = {{Django 1.4.x to 1.6.x auth framework CPU DoS via long password}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2013},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-1443},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-1443/}}
}