PT-2023-7994 · Django+5 · Django+5
Mprogrammer
·
Published
2023-09-04
·
Updated
2026-01-03
·
CVE-2023-41164
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Django versions 3.2 through 3.2.20
Django versions 4.1 through 4.1.10
Django versions 4.2 through 4.2.4
Description
The issue is related to the
django.utils.encoding.uri to iri() component of the Django web application platform, which is vulnerable to a potential denial of service (DoS) attack due to incorrect input validation. This vulnerability can be exploited by a remote attacker, allowing them to cause a denial of service. The attack is possible via certain inputs with a very large number of Unicode characters.Recommendations
For Django versions 3.2 through 3.2.20, update to version 3.2.21 or later.
For Django versions 4.1 through 4.1.10, update to version 4.1.11 or later.
For Django versions 4.2 through 4.2.4, update to version 4.2.5 or later.
As a temporary workaround, consider restricting the input to the
uri to iri() function to prevent large amounts of Unicode characters.Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Django
Linuxmint
Ubuntu