Django Denial-of-service in django.utils.text.Truncator
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-43665US | high7.5 | — | ||
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potent… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2024/03/04/1WEB
- https://docs.djangoproject.com/en/4.2/releases/securityWEB
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/be9c27c4d18c2e6a5be8af4e53c0797440794473WEB
- https://github.com/django/django/commit/c7b7024742250414e426ad49fb80db943e7ba4e8WEB
- https://github.com/django/django/commit/ccdade1a0262537868d7ca64374de3d957ca50c5WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-226.yamlWEB
- https://groups.google.com/forum/#!forum/django-announceWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan