CVE-2019-14232
published 2019-08-02CVE-2019-14232: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words()…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.50%
87.7th percentile
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-django | < python-django 3:3.2.25-0+deb12u1 (bookworm) | python-django 3:3.2.25-0+deb12u1 (bookworm) |
| djangoproject | django | >= 1.11 < 1.11.23 | 1.11.23 |
| djangoproject | django | >= 1.11a1 < 1.11.23 | 1.11.23 |
| djangoproject | django | >= 2.1 < 2.1.11 | 2.1.11 |
| djangoproject | django | >= 2.1a1 < 2.1.11 | 2.1.11 |
| djangoproject | django | >= 2.2 < 2.2.4 | 2.2.4 |
| djangoproject | django | >= 2.2a1 < 2.2.4 | 2.2.4 |
| djangoproject | django | >= 3.2 < 3.2.25 | 3.2.25 |
| djangoproject | django | >= 3.2 < 3.2.22 | 3.2.22 |
| djangoproject | django | >= 3.2 < 3.2.25 | 3.2.25 |
| djangoproject | django | >= 3.2a1 < 3.2.22 | 3.2.22 |
| djangoproject | django | >= 4.1 < 4.1.12 | 4.1.12 |
| djangoproject | django | >= 4.1a1 < 4.1.12 | 4.1.12 |
| djangoproject | django | >= 4.2 < 4.2.11 | 4.2.11 |
| djangoproject | django | >= 4.2 < 4.2.6 | 4.2.6 |
| djangoproject | django | >= 4.2 < 4.2.11 | 4.2.11 |
| djangoproject | django | >= 4.2a1 < 4.2.6 | 4.2.6 |
| djangoproject | django | >= 5.0 < 5.0.3 | 5.0.3 |
| djangoproject | django | >= 5.0 < 5.0.3 | 5.0.3 |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-27351: In Django 3
osv·2024-03-15·CVSS 7.5
CVE-2024-27351 [HIGH] CVE-2024-27351: In Django 3
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
OSV
Regular expression denial-of-service in Django
osv·2024-03-15·CVSS 7.5
CVE-2024-27351 [HIGH] Regular expression denial-of-service in Django
Regular expression denial-of-service in Django
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
GHSA
Regular expression denial-of-service in Django
ghsa·2024-03-15·CVSS 7.5
CVE-2024-27351 [HIGH] CWE-1333 Regular expression denial-of-service in Django
Regular expression denial-of-service in Django
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
OSV
CVE-2023-43665: In Django 3
osv·2023-11-03·CVSS 7.5
CVE-2023-43665 [HIGH] CVE-2023-43665: In Django 3
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
GHSA
Django Denial-of-service in django.utils.text.Truncator
ghsa·2023-11-03·CVSS 7.5
CVE-2023-43665 [HIGH] CWE-1284 Django Denial-of-service in django.utils.text.Truncator
Django Denial-of-service in django.utils.text.Truncator
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
OSV
Django Denial-of-service in django.utils.text.Truncator
osv·2023-11-03·CVSS 7.5
CVE-2023-43665 [HIGH] Django Denial-of-service in django.utils.text.Truncator
Django Denial-of-service in django.utils.text.Truncator
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
OSV
Django Denial-of-service in django.utils.text.Truncator
osv·2019-08-06
CVE-2019-14232 [HIGH] Django Denial-of-service in django.utils.text.Truncator
Django Denial-of-service in django.utils.text.Truncator
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If `django.utils.text.Truncator`'s `chars()` and `words()` methods were passed the `html=True` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The `chars()` and `words()` methods are used to implement the `truncatechars_htm`l and `truncatewords_html` template filters, which were thus vulnerable.
GHSA
Django Denial-of-service in django.utils.text.Truncator
ghsa·2019-08-06
CVE-2019-14232 [HIGH] CWE-400 Django Denial-of-service in django.utils.text.Truncator
Django Denial-of-service in django.utils.text.Truncator
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If `django.utils.text.Truncator`'s `chars()` and `words()` methods were passed the `html=True` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The `chars()` and `words()` methods are used to implement the `truncatechars_htm`l and `truncatewords_html` template filters, which were thus vulnerable.
OSV
CVE-2019-14232: An issue was discovered in Django 1
osv·2019-08-02·CVSS 7.5
CVE-2019-14232 [HIGH] CVE-2019-14232: An issue was discovered in Django 1
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
OSV
python-django vulnerabilities
osv·2019-08-01·CVSS 7.5
CVE-2019-14232 [HIGH] python-django vulnerabilities
python-django vulnerabilities
It was discovered that Django incorrectly handled the Truncator function. A
remote attacker could possibly use this issue to cause Django to consume
resources, leading to a denial of service. (CVE-2019-14232)
It was discovered that Django incorrectly handled the strip_tags function.
A remote attacker could possibly use this issue to cause Django to consume
resources, leading to a denial of service. (CVE-2019-14233)
It was discovered that Django incorrectly handled certain lookups in the
PostgreSQL support. A remote attacker could possibly use this issue to
perform SQL injection attacks. (CVE-2019-14234)
It was discovered that Django incorrectly handled certain invalid UTF-8
octet sequences. A remote attacker could possibly use this issue to cause
Django to
Red Hat
python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
vendor_redhat·2024-03-04·CVSS 7.5
CVE-2024-27351 [HIGH] CWE-1333 python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
An inefficient regular expression complexity flaw was found in the Truncator.words function and truncatewords_html filter of Django. This issue may allow an attacker to use a suitably crafted string to cause a denial of service.
Package: ansible-tower (Red Hat Ansible Automation Platform 1.2) - Not affected
Package: python-django (
Debian
CVE-2024-27351: python-django - In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django...
vendor_debian·2024·CVSS 7.5
CVE-2024-27351 [HIGH] CVE-2024-27351: python-django - In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django...
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
Scope: local
bookworm: resolved (fixed in 3:3.2.25-0+deb12u1)
bullseye: resolved (fixed in 2:2.2.28-1~deb11u7)
forky: resolved (fixed in 3:4.2.11-1)
sid: resolved (fixed in 3:4.2.11-1)
trixie: resolved (fixed in 3:4.2.11-1)
Red Hat
python-django: Denial-of-service possibility in django.utils.text.Truncator
vendor_redhat·2023-10-04·CVSS 7.5
CVE-2023-43665 [HIGH] CWE-1333 python-django: Denial-of-service possibility in django.utils.text.Truncator
python-django: Denial-of-service possibility in django.utils.text.Truncator
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given cert
Debian
CVE-2023-43665: python-django - In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django...
vendor_debian·2023·CVSS 7.5
CVE-2023-43665 [HIGH] CVE-2023-43665: python-django - In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django...
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
Scope: local
bookworm: resolved (fixed in 3:3.2.25-0+deb12u1)
bullseye: resolved (fixed in 2:2.2.28-1~deb11u7)
forky: resolved (fixed in 3:4.2.6-1)
sid: resolved (fixed in 3:4.2.6-1)
trixie: resolved (fixed in 3:4.2.6-1)
Red Hat
Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS
vendor_redhat·2019-08-01·CVSS 7.5
CVE-2019-14232 [HIGH] CWE-20 Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS
Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Statement: This issue affects the versions of python-django as shipped with Red Hat Gluster Storage 3, Red Hat Ceph Storage 2 and 3, as it contains the vulnerable code.
This issue affects Red Hat Update Infrastructure for Cloud Providers,
Ubuntu
Django vulnerabilities
vendor_ubuntu·2019-08-01·CVSS 7.5
CVE-2019-14232 [HIGH] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
It was discovered that Django incorrectly handled the Truncator function. A
remote attacker could possibly use this issue to cause Django to consume
resources, leading to a denial of service. (CVE-2019-14232)
It was discovered that Django incorrectly handled the strip_tags function.
A remote attacker could possibly use this issue to cause Django to consume
resources, leading to a denial of service. (CVE-2019-14233)
It was discovered that Django incorrectly handled certain lookups in the
PostgreSQL support. A remote attacker could possibly use this issue to
perform SQL injection attacks. (CVE-2019-14234)
It was discovered that Django incorrectly handled certain invalid UTF-8
octet sequences. A remote a
Debian
CVE-2019-14232: python-django - An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, an...
vendor_debian·2019·CVSS 7.5
CVE-2019-14232 [HIGH] CVE-2019-14232: python-django - An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, an...
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Scope: local
bookworm: resolved (fixed in 3:3.2.25-0+deb12u1)
bullseye: resolved (fixed in 2:2.2.4-1)
forky: resolved (fixed in 2:2.2.4-1)
sid: resolved (fixed in 2:2.2.4-1)
trixie: resolved (fixed in 2:2.2.4-1)
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
hackerone·2024-04-28·CVSS 7.5
CVE-2024-27351 [HIGH] CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
# TL;DR
**CVE-2024-27351**: Potential regular expression denial-of-service in `django.utils.text.Truncator.words()`
# Details:
`django.utils.text.Truncator.words()` method (with `html=True`) and `truncatewords_html` template filter were subject to a potential regular expression denial-of-service attack using a suitably crafted string (follow up to CVE-2019-14232 and CVE-2023-43665).
- The `Truncator` class truncates text based on word count.
- When the `html` flag is set, the internal `_truncate_html()` method is used.
- This method relies on regular expressions stored in variables (`re_chars` and `re_words`) to perform the truncation.
- These regular expressions are vulnerable to ReD
Bugzilla
CVE-2024-27351 python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
bugzilla·2024-02-26·CVSS 7.5
CVE-2024-27351 [HIGH] CVE-2024-27351 python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
CVE-2024-27351 python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
You're receiving this message because you are on the security prenotification list for the Django web framework; information about this list can be
found in our security policy [1].
In accordance with that policy, a set of security releases will be issued on Monday, March 4, 2024 around 900 UTC. This message contains descriptions
of the issue, descriptions of the changes which will be made to Django, and the patches which will be applied to Django.
``django.utils.text.Truncator.words()`` method (with ``html=True``) and
``truncatewords_html`` template filter were subject to a potential
regular expression denial-of-service attack using a suitably crafted string
(follow up to
Bugzilla
CVE-2023-43665 python-django: Denial-of-service possibility in django.utils.text.Truncator
bugzilla·2023-09-27·CVSS 7.5
CVE-2023-43665 [HIGH] CVE-2023-43665 python-django: Denial-of-service possibility in django.utils.text.Truncator
CVE-2023-43665 python-django: Denial-of-service possibility in django.utils.text.Truncator
Following the fix for CVE-2019-14232, the regular expressions used in the implementation of django.utils.text.Truncator’s chars() and words() methods (with html=True) were revised and improved. However, these regular expressions still exhibited linear backtracking complexity, so when given a very long, potentially malformed HTML input, the evaluation would still be slow, leading to a potential denial of service vulnerability.
The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus also vulnerable.
The input processed by Truncator, when operating in HTML mode, has been limited to the first five million characters in order
Bugzilla
CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [openstack-rdo]
bugzilla·2019-08-29·CVSS 7.5
CVE-2019-14232 [HIGH] CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [openstack-rdo]
CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit me
Bugzilla
CVE-2019-14232 python-django16: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [epel-7]
bugzilla·2019-08-01·CVSS 7.5
CVE-2019-14232 [HIGH] CVE-2019-14232 python-django16: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [epel-7]
CVE-2019-14232 python-django16: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Dis
Bugzilla
CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [epel-7]
bugzilla·2019-08-01·CVSS 7.5
CVE-2019-14232 [HIGH] CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [epel-7]
CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discu
Bugzilla
CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [fedora-30]
bugzilla·2019-08-01·CVSS 7.5
CVE-2019-14232 [HIGH] CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [fedora-30]
CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [fedora-30]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-30.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2019-14234 python-django16: Django: SQL injection possibility in key and index lookups for JSONField/HStoreField [epel-7]
bugzilla·2019-08-01·CVSS 9.8
CVE-2019-14234 [CRITICAL] CVE-2019-14234 python-django16: Django: SQL injection possibility in key and index lookups for JSONField/HStoreField [epel-7]
CVE-2019-14234 python-django16: Django: SQL injection possibility in key and index lookups for JSONField/HStoreField [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discuss
Bugzilla
CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [fedora-29]
bugzilla·2019-08-01·CVSS 7.5
CVE-2019-14232 [HIGH] CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [fedora-29]
CVE-2019-14232 python-django: Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS [fedora-29]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-29.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2019-14232 Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS
bugzilla·2019-07-30·CVSS 7.5
CVE-2019-14232 [HIGH] CVE-2019-14232 Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS
CVE-2019-14232 Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS
If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the :tfilter:truncatechars_html and :tfilter:truncatewords_html template filters, which were thus vulnerable.
Discussion:
Created python-django tracking bugs for this issue:
Affects: epel-7 [bug 1735768]
Affects: fedora-29 [bug 1735770]
Affects: fedora-30 [bug 1735771]
Created python-django16 tracking bugs for this issue:
Affects: epel-7 [bug 1735769]
---
External References:
https://www.djangoproject.com/
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlhttp://www.openwall.com/lists/oss-security/2023/10/04/6http://www.openwall.com/lists/oss-security/2024/03/04/1https://docs.djangoproject.com/en/dev/releases/security/https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDshttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/https://seclists.org/bugtraq/2019/Aug/15https://security.gentoo.org/glsa/202004-17https://security.netapp.com/advisory/ntap-20190828-0002/https://www.debian.org/security/2019/dsa-4498https://www.djangoproject.com/weblog/2019/aug/01/security-releases/http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlhttp://www.openwall.com/lists/oss-security/2023/10/04/6http://www.openwall.com/lists/oss-security/2024/03/04/1https://docs.djangoproject.com/en/dev/releases/security/https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDshttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/https://seclists.org/bugtraq/2019/Aug/15https://security.gentoo.org/glsa/202004-17https://security.netapp.com/advisory/ntap-20190828-0002/https://www.debian.org/security/2019/dsa-4498https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
2019-08-02
Published