PT-2019-20165 · Django Software Foundation · Django

Publicado 2019-08-02 · Atualizado 2019-08-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Django versions 1.11.x through 1.11.22 Django versions 2.1.x through 2.1.10 Django versions 2.2.x through 2.2.3

Description An issue in django.utils.encoding.uri to iri can lead to significant memory usage due to recursion when repercent-encoding invalid UTF-8 octet sequences, given certain inputs.

Recommendations For Django versions 1.11.x through 1.11.22, update to version 1.11.23 or later. For Django versions 2.1.x through 2.1.10, update to version 2.1.11 or later. For Django versions 2.2.x through 2.2.3, update to version 2.2.4 or later.

Identificadores relacionados

PYSEC-2019-84

Produtos afetados

Django

Referências · 11

• https://security.netapp.com/advisory/ntap-20190828-0002 · Nota
• https://seclists.org/bugtraq/2019/Aug/15 · Nota
• https://djangoproject.com/weblog/2019/aug/01/security-releases · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html · Nota
• https://docs.djangoproject.com/en/dev/releases/security · Nota
• https://osv.dev/vulnerability/PYSEC-2019-84 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK · Aviso do Fabricante
• https://debian.org/security/2019/dsa-4498 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202004-17 · Nota
• https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs · Nota