CVE-2023-43665

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-43665
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-43665.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-43665
Aliases
Downstream
Related
Published
2023-11-03T00:00:00Z
Modified
2026-05-18T05:55:55.935116469Z
Summary
[none]
Details

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "3.2"
                },
                {
                    "fixed": "3.2.22"
                },
                {
                    "introduced": "4.1"
                },
                {
                    "fixed": "4.1.12"
                },
                {
                    "introduced": "4.2"
                },
                {
                    "fixed": "4.2.6"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43665.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/django/django

Affected ranges

Type
GIT
Repo
https://github.com/django/django
Events
Introduced
3591e1c1acbd7c13174275367c3fdf012cb0413b
Fixed
3106e94e52a0a7786d49803c86b3139df113d36d
Introduced
9fee86e44dd83dc968ec443adcde191b3eba1286
Fixed
865974ee933ac0648fabe4458136ce1ceec62192
Introduced
97aa3b7f08f51669e118f3af5ca91026e39664c3
Fixed
c22017bd1dddb5b57d8a179e6378ef0c8d7f5eeb
Database specific 
{
    "cpe": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "3.2"
        },
        {
            "fixed": "3.2.22"
        },
        {
            "introduced": "4.1"
        },
        {
            "fixed": "4.1.12"
        },
        {
            "introduced": "4.2"
        },
        {
            "fixed": "4.2.6"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-43665.json"