Django Denial-of-service in django.utils.text.Truncator
Moderate severity
GitHub Reviewed
Published
Nov 3, 2023
to the GitHub Advisory Database
•
Updated Sep 20, 2024
Package
Affected versions
>= 3.2a1, < 3.2.22
>= 4.1a1, < 4.1.12
>= 4.2a1, < 4.2.6
Patched versions
3.2.22
4.1.12
4.2.6
Description
Published by the National Vulnerability Database
Nov 3, 2023
Published to the GitHub Advisory Database
Nov 3, 2023
Reviewed
Nov 3, 2023
Last updated
Sep 20, 2024
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
References