BIT-django-2023-43665

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2023-43665.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-django-2023-43665
Aliases
Published
2024-03-06T10:51:25.579Z
Modified
2024-05-02T07:52:56.618Z
Summary
[none]
Details

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Database specific
{
    "cpes": [
        "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / django

Package

Name
django
Purl
pkg:bitnami/django

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
3.2.0
Fixed
3.2.22
Introduced
4.1.0
Fixed
4.1.12
Introduced
4.2.0
Fixed
4.2.6