PT-2019-20162 · Django · Django

Publicado 2019-08-02 · Atualizado 2019-08-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Django versions 1.11.x through 1.11.22 Django versions 2.1.x through 2.1.10 Django versions 2.2.x through 2.2.3

Description An issue was discovered where the chars() and words() methods in django.utils.text.Truncator were extremely slow to evaluate certain inputs due to a catastrophic backtracking issue in a regular expression when the html=True argument was passed. This affected the truncatechars html and truncatewords html template filters.

Recommendations For Django versions 1.11.x through 1.11.22, update to version 1.11.23 or later. For Django versions 2.1.x through 2.1.10, update to version 2.1.11 or later. For Django versions 2.2.x through 2.2.3, update to version 2.2.4 or later.

Identificadores relacionados

PYSEC-2019-81

Produtos afetados

Django

Referências · 11

• https://security.netapp.com/advisory/ntap-20190828-0002 · Nota
• https://seclists.org/bugtraq/2019/Aug/15 · Nota
• https://djangoproject.com/weblog/2019/aug/01/security-releases · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html · Nota
• https://docs.djangoproject.com/en/dev/releases/security · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK · Aviso do Fabricante
• https://debian.org/security/2019/dsa-4498 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202004-17 · Nota
• https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs · Nota
• https://osv.dev/vulnerability/PYSEC-2019-81 · Aviso do Fabricante