PT-2019-20163 · Django Software Foundation · Django

Published 2019-08-02 · Updated 2019-08-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Django versions 1.11.x through 1.11.22 Django versions 2.1.x through 2.1.10 Django versions 2.2.x through 2.2.3

Description An issue was discovered due to the behavior of the underlying HTMLParser. The django.utils.html.strip tags function would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.

Recommendations For Django versions 1.11.x through 1.11.22, update to version 1.11.23 or later. For Django versions 2.1.x through 2.1.10, update to version 2.1.11 or later. For Django versions 2.2.x through 2.2.3, update to version 2.2.4 or later.

Related Identifiers

PYSEC-2019-82

Affected Products

Django

References · 11

• https://osv.dev/vulnerability/PYSEC-2019-82 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK · Vendor Advisory
• https://debian.org/security/2019/dsa-4498 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190828-0002 · Note
• https://seclists.org/bugtraq/2019/Aug/15 · Note
• https://djangoproject.com/weblog/2019/aug/01/security-releases · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html · Note
• https://docs.djangoproject.com/en/dev/releases/security · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html · Note
• https://security.gentoo.org/glsa/202004-17 · Note
• https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs · Note