GHSA-h8gc-pgj2-vjm3

Source

https://github.com/advisories/GHSA-h8gc-pgj2-vjm3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-h8gc-pgj2-vjm3/GHSA-h8gc-pgj2-vjm3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h8gc-pgj2-vjm3

Aliases

Published

2023-11-03T06:36:30Z

Modified

2024-11-20T05:38:02.564100Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Django Denial-of-service in django.utils.text.Truncator

Details

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Database specific

{
    "nvd_published_at": "2023-11-03T05:15:30Z",
    "cwe_ids": [
        "CWE-1284",
        "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-03T19:35:28Z"
}

References

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.2a1

Fixed

3.2.22

Affected versions

3.*

3.2a1

3.2b1

3.2rc1

3.2

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.2.9

3.2.10

3.2.11

3.2.12

3.2.13

3.2.14

3.2.15

3.2.16

3.2.17

3.2.18

3.2.19

3.2.20

3.2.21

Ecosystem specific

{
    "affected_functions": [
        "django.utils.text.Truncator"
    ]
}

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1a1

Fixed

4.1.12

Affected versions

4.*

4.1a1

4.1b1

4.1rc1

4.1

4.1.1

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.1.7

4.1.8

4.1.9

4.1.10

4.1.11

Ecosystem specific

{
    "affected_functions": [
        "django.utils.text.Truncator"
    ]
}

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.2a1

Fixed

4.2.6

Affected versions

4.*

4.2a1

4.2b1

4.2rc1

4.2

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

Ecosystem specific

{
    "affected_functions": [
        "django.utils.text.Truncator"
    ]
}