GHSA-h8gc-pgj2-vjm3

Suggest an improvement
Source
https://github.com/advisories/GHSA-h8gc-pgj2-vjm3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-h8gc-pgj2-vjm3/GHSA-h8gc-pgj2-vjm3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h8gc-pgj2-vjm3
Aliases
Published
2023-11-03T06:36:30Z
Modified
2024-09-20T15:48:06.765444Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Django Denial-of-service in django.utils.text.Truncator
Details

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

References

Affected packages

PyPI / django

Package

Name
django
View open source insights on deps.dev
Purl
pkg:pypi/django

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.2a1
Fixed
3.2.22

Affected versions

3.*

3.2a1
3.2b1
3.2rc1
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.20
3.2.21

Ecosystem specific 

{
    "affected_functions": [
        "django.utils.text.Truncator"
    ]
}

PyPI / django

Package

Name
django
View open source insights on deps.dev
Purl
pkg:pypi/django

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1a1
Fixed
4.1.12

Affected versions

4.*

4.1a1
4.1b1
4.1rc1
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1.10
4.1.11

Ecosystem specific 

{
    "affected_functions": [
        "django.utils.text.Truncator"
    ]
}

PyPI / django

Package

Name
django
View open source insights on deps.dev
Purl
pkg:pypi/django

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2a1
Fixed
4.2.6

Affected versions

4.*

4.2a1
4.2b1
4.2rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5

Ecosystem specific 

{
    "affected_functions": [
        "django.utils.text.Truncator"
    ]
}