PT-2019-5099 · Django+3 · Django+3
Guido Vranken
+1
·
Published
2019-08-01
·
Updated
2026-01-03
·
CVE-2019-14232
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 1.11.x through 1.11.22
Django versions 2.1.x through 2.1.10
Django versions 2.2.x through 2.2.3
Description
The issue is related to the
django.utils.text.Truncator class, specifically the chars() and words() methods. When these methods are passed the html=True argument, they can be extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. This vulnerability can be exploited to cause a denial of service. The chars() and words() methods are used to implement the truncatechars html and truncatewords html template filters.Recommendations
For Django versions 1.11.x through 1.11.22, update to version 1.11.23 or later.
For Django versions 2.1.x through 2.1.10, update to version 2.1.11 or later.
For Django versions 2.2.x through 2.2.3, update to version 2.2.4 or later.
As a temporary workaround, consider avoiding the use of the
html=True argument in the chars() and words() methods until a patch is available.Fix
RCE
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Django
Suse
Ubuntu