~ / search / GHSA-c4qh-4vgv-qc6g

GHSA-c4qh-4vgv-qc6g

Django Denial-of-service in django.utils.text.Truncator

Source: GitHub Advisory Database (reviewed) High CVE-2019-14232

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 1.11a1, < 1.11.23 1.11.23
PyPI Django >= 2.1a1, < 2.1.11 2.1.11
PyPI Django >= 2.2a1, < 2.2.4 2.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If `django.utils.text.Truncator`'s `chars()` and `words()` methods were passed the `html=True` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The `chars()` and `words()` methods are used to implement the `truncatechars_htm`l and `truncatewords_html` template filters, which were thus vulnerable.

References

External links from the advisory. They lead to third-party sites.