Thanks to Brian for reporting this issue and to Nikhil and Stuart for following up.
I think, eventually, we want to:
1) Stop shipping our own wsgi container and let deployers pick their own
2) Recommend deployers to always use a rate limit. I think, as Stuart also suggested, that a third party rate limit software should do the trick here.
As far as the database goes, I believe 244573 should help to prevent attackers from exploiting this issue.
Thanks to Brian for reporting this issue and to Nikhil and Stuart for following up.
I think, eventually, we want to:
1) Stop shipping our own wsgi container and let deployers pick their own
2) Recommend deployers to always use a rate limit. I think, as Stuart also suggested, that a third party rate limit software should do the trick here.
As far as the database goes, I believe 244573 should help to prevent attackers from exploiting this issue.
Brian, would you agree with this?