PT-2019-20162 · Django · Django
Published
2019-08-02
·
Updated
2019-08-02
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Django versions 1.11.x through 1.11.22
Django versions 2.1.x through 2.1.10
Django versions 2.2.x through 2.2.3
Description
An issue was discovered where the
chars() and words() methods in django.utils.text.Truncator were extremely slow to evaluate certain inputs due to a catastrophic backtracking issue in a regular expression when the html=True argument was passed. This affected the truncatechars html and truncatewords html template filters.Recommendations
For Django versions 1.11.x through 1.11.22, update to version 1.11.23 or later.
For Django versions 2.1.x through 2.1.10, update to version 2.1.11 or later.
For Django versions 2.2.x through 2.2.3, update to version 2.2.4 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Django