CVE-2023-43665

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-43665

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-43665.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-43665

Aliases

Related

Published

2023-11-03T05:15:30Z

Modified

2024-10-12T11:06:48.329215Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

References

Affected packages

Debian:11 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2:2.*

2:2.2.24-1

2:2.2.25-1~deb11u1

2:2.2.26-1~deb11u1

2:2.2.28-1~deb11u1

2:2.2.28-1~deb11u2

2:3.*

2:3.0~alpha1-1

2:3.0~beta1-1

2:3.0~rc1-1

2:3.0-1

2:3.0.1-1

2:3.0.2-1

2:3.0.4-1

2:3.0.5-1

2:3.0.6-1

2:3.0.7-1

2:3.0.7-2

2:3.1~beta1-1

2:3.1~rc1-1

2:3.1-1

2:3.1-2

2:3.1.1-1

2:3.1.2-1

2:3.1.3-1

2:3.1.4-1

2:3.1.5-1

2:3.2~alpha1-1

2:3.2~alpha1-2

2:3.2~beta1-1

2:3.2~rc1-1

2:3.2-1

2:3.2.1-1

2:3.2.2-1

2:3.2.3-1

2:3.2.4-1

2:3.2.5-1

2:3.2.5-2

2:3.2.6-1

2:3.2.7-1

2:3.2.7-2

2:3.2.7-3

2:3.2.7-4

2:3.2.8-1

2:3.2.9-1

2:3.2.9-2~bpo11+1

2:3.2.9-2

2:3.2.10-1

2:3.2.10-2~bpo11+1

2:3.2.10-2~bpo11+2

2:3.2.10-2

2:3.2.11-1

2:3.2.11-2

2:3.2.12-1~bpo11+1

2:3.2.12-1

2:3.2.12-2

2:3.2.13-1

2:4.*

2:4.0~alpha1-1

2:4.0~beta1-1

2:4.0~rc1-1

2:4.0-1

2:4.0.1-1

2:4.0.1-2

2:4.0.2-1

2:4.0.3-1

2:4.0.4-1

2:4.0.5-1

2:4.0.5-2

2:4.0.6-1

2:4.1~alpha1-1

2:4.1~beta1-1

2:4.1~rc1-1

3:3.*

3:3.2.14-1

3:3.2.15-1

3:3.2.16-1

3:3.2.16-2

3:3.2.17-1

3:3.2.18-1

3:3.2.19-1

3:3.2.20-1

3:3.2.20-1.1

3:3.2.21-1

3:4.*

3:4.1-1

3:4.1.1-1

3:4.1.2-1

3:4.1.3-1

3:4.1.4-1

3:4.1.5-1

3:4.2~alpha1-1

3:4.2~beta1-1

3:4.2~rc1-1

3:4.2-1

3:4.2.1-1

3:4.2.2-1

3:4.2.3-1

3:4.2.4-1

3:4.2.5-1

3:4.2.5-2

3:4.2.6-1

3:4.2.8-1

3:4.2.9-1

3:4.2.10-1

3:4.2.11-1

3:4.2.13-1

3:4.2.14-1

3:4.2.15-1~bpo12+1

3:4.2.15-1

3:4.2.16-1

3:5.*

3:5.0~alpha1-1

3:5.0~rc1-1

3:5.0-1

3:5.0.1-1

3:5.0.2-1

3:5.0.3-1

3:5.0.4-1

3:5.0.6-1

3:5.1~alpha1-1

3:5.1~beta1-1

3:5.1~rc1-1

3:5.1-1

3:5.1.1-1

3:5.1.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3:3.*

3:3.2.19-1

3:3.2.19-1+deb12u1~bpo11+1

3:3.2.19-1+deb12u1

3:3.2.19-1+deb12u2

3:3.2.20-1

3:3.2.20-1.1

3:3.2.21-1

3:4.*

3:4.1-1

3:4.1.1-1

3:4.1.2-1

3:4.1.3-1

3:4.1.4-1

3:4.1.5-1

3:4.2~alpha1-1

3:4.2~beta1-1

3:4.2~rc1-1

3:4.2-1

3:4.2.1-1

3:4.2.2-1

3:4.2.3-1

3:4.2.4-1

3:4.2.5-1

3:4.2.5-2

3:4.2.6-1

3:4.2.8-1

3:4.2.9-1

3:4.2.10-1

3:4.2.11-1

3:4.2.13-1

3:4.2.14-1

3:4.2.15-1~bpo12+1

3:4.2.15-1

3:4.2.16-1

3:5.*

3:5.0~alpha1-1

3:5.0~rc1-1

3:5.0-1

3:5.0.1-1

3:5.0.2-1

3:5.0.3-1

3:5.0.4-1

3:5.0.6-1

3:5.1~alpha1-1

3:5.1~beta1-1

3:5.1~rc1-1

3:5.1-1

3:5.1.1-1

3:5.1.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3:4.2.6-1

Affected versions

3:3.*

3:3.2.19-1

3:3.2.20-1

3:3.2.20-1.1

3:3.2.21-1

3:4.*

3:4.1-1

3:4.1.1-1

3:4.1.2-1

3:4.1.3-1

3:4.1.4-1

3:4.1.5-1

3:4.2~alpha1-1

3:4.2~beta1-1

3:4.2~rc1-1

3:4.2-1

3:4.2.1-1

3:4.2.2-1

3:4.2.3-1

3:4.2.4-1

3:4.2.5-1

3:4.2.5-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/django/django

Affected ranges

Type: GIT
Repo: https://github.com/django/django
Events: Introduced

b6475d7d7940f3ce575e0b0f2d83e517f899b4cf

Fixed

3106e94e52a0a7786d49803c86b3139df113d36d

Affected versions

3.*

3.2

3.2.1

3.2.10

3.2.11

3.2.12

3.2.13

3.2.14

3.2.15

3.2.16

3.2.17

3.2.18

3.2.19

3.2.2

3.2.20

3.2.21

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.2.9