CVE-2019-14235

mediumPriorität · verfolgen · 31EPSS 0.031 · 88. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

3.07% (88th) EPSS

CVSS 5 · medium

Is it mine?

46 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenpython-django-0:2.1.11-1.el8ost.src as a component of Red Hat OpenStack Platform 15.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1324
Behobenpython-django-bash-completion-0:2.1.11-1.el8ost.noarch as a component of Red Hat OpenStack Platform 15.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1324
Behobenpython3-django-0:2.1.11-1.el8ost.noarch as a component of Red Hat OpenStack Platform 15.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1324
Behobenpython-django-0:1.11.27-1.el7ost.src as a component of Red Hat OpenStack Platform 13.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython-django-0:1.11.27-1.el7ost.src as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython-django-bash-completion-0:1.11.27-1.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython-django-bash-completion-0:1.11.27-1.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython2-django-0:1.11.27-1.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython2-django-0:1.11.27-1.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.06.9mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Red Hat Product Security US

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-674USprimärCWE-20USCWE-400USCWE-674US

betroffene Produkte (46)

Betroffene Produkte und Versionsbereiche.

Gentoo Linuxalle Versionencert_bundDEcpe:/o:gentoo:linux:-
Open Source Django < 3.2.25alle Versionencert_bundDE
Open Source Django < 4.2.11alle Versionencert_bundDE
Open Source Django < 5.0.3alle Versionencert_bundDE
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat OpenStack <= 15alle Versionencert_bundDE
Open Source Django< 3.2.25cert_bundDE
Open Source Django< 4.2.11cert_bundDE
Open Source Django< 5.0.3cert_bundDE
Red Hat OpenStack≤ 15cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
Django Software Foundation Django1.11 → 1.11.23fstec_bduRU
Django Software Foundation Django2.1 → 2.1.11fstec_bduRU
Django Software Foundation Django2.2 → 2.2.4fstec_bduRU
Fedora Project Fedora≤ 30fstec_bduRU
Novell Inc. HPE Helion Openstack≤ 8fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.1fstec_bduRU
Novell Inc. SUSE OpenStack Cloud≤ 8fstec_bduRU
Novell Inc. SUSE OpenStack Cloud≤ Crowbar 9fstec_bduRU
Novell Inc. SUSE OpenStack Cloud≤ 9fstec_bduRU

20 von 46 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2020:1324Red Hat Security Advisory: python-django security update2020-04-06csaf · redhat_csafUS
An update for python-django is now available for Red Hat OpenStack Platform 15 (Stein). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:4390Red Hat Security Advisory: python-django security update2020-10-28csaf · redhat_csafUS
An update for python-django is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2024-0539Red Hat OpenStack: Mehrere SchwachstellenDeutsch2020-04-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenStack ausnutzen, um eine SQL-Injection durchzuführen, einen Denial of Service Zustand herbeizuführen oder Informationen offenzulegen.
GHSA-v9qg-3j8p-r63vUncontrolled Recursion in Django2019-08-06ghsa · osvUS
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
PYSEC-2019-142019-08-02vendor · osvUS
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund redhat_csaf NVD CVE.org MITRE

veröffentlicht 2019-08-02geändert 2026-06-17

verwandt (725)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-45105US	medium5.9	100.0% (100th)	Exploit	2021-12-18
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker wit…
CVE-2024-25111US	high7.5	65.3% (99th)	—	2024-03-06
Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncont…
CVE-2021-42697US	high7.5	36.1% (98th)	Exploit	2021-11-02
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service at…
CVE-2023-50269US	high7.5	57.6% (99th)	—	2023-12-14
Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may…
CVE-2009-3563US	medium6.4	32.1% (98th)	Exploit	2009-12-09
ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed…

+720 weitere

Referenzen (45)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan