Django Denial-of-service in django.utils.text.Truncator
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-43665US | high7.5 | — | ||
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potent… | ||||
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2024/03/04/1WEB
- https://docs.djangoproject.com/en/4.2/releases/securityWEB
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/be9c27c4d18c2e6a5be8af4e53c0797440794473WEB
- https://github.com/django/django/commit/c7b7024742250414e426ad49fb80db943e7ba4e8WEB
- https://github.com/django/django/commit/ccdade1a0262537868d7ca64374de3d957ca50c5WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-226.yamlWEB
- https://groups.google.com/forum/#!forum/django-announceWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan