Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-C4QH-4VGV-QC6G
HistoryAug 06, 2019 - 1:43 a.m.

Django Denial-of-service in django.utils.text.Truncator

2019-08-0601:43:29
CWE-400
GitHub Advisory Database
github.com
12

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.029 Low

EPSS

Percentile

90.8%

JSON

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

Affected configurations

Vulners
Node
django-registration_projectdjango-registrationRange<2.2.4django
OR
django-registration_projectdjango-registrationRange<2.1.11django
OR
django-registration_projectdjango-registrationRange<1.11.23django
CPENameOperatorVersion
djangolt2.2.4
djangolt2.1.11
djangolt1.11.23

References

Related

vulnrichment 1
alpinelinux 3
nvd 3
debiancve 3
redhatcve 1
veracode 1
cve 3
ubuntucve 3
osv 12
prion 2
cvelist 3
nessus 18
openvas 10
debian 3
github 2
hackerone 1
archlinux 2
altlinux 2
ubuntu 1
freebsd 1
redhat 2
fedora 2
suse 2
gentoo 1
vulnrichment
vulnrichment
CVE-2019-14232
2019-08-02 00:00:00
alpinelinux
alpinelinux
CVE-2019-14232
2019-08-02 15:15:11
CVE-2023-43665
2023-11-03 05:15:30
CVE-2024-27351
2024-03-15 20:15:09
nvd
nvd
CVE-2019-14232
2019-08-02 15:15:11
CVE-2023-43665
2023-11-03 05:15:30
CVE-2024-27351
2024-03-15 20:15:09
debiancve
debiancve
CVE-2019-14232
2019-08-02 15:15:11
CVE-2023-43665
2023-11-03 05:15:30
CVE-2024-27351
2024-03-15 20:15:09
redhatcve
redhatcve
CVE-2019-14232
2020-04-08 21:41:20
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2019-08-02 09:44:23
cve
cve
CVE-2019-14232
2019-08-02 15:15:11
CVE-2023-43665
2023-11-03 05:15:30
CVE-2024-27351
2024-03-15 20:15:09
ubuntucve
ubuntucve
CVE-2019-14232
2019-08-01 00:00:00
CVE-2023-43665
2023-10-04 00:00:00
CVE-2024-27351
2024-03-04 00:00:00
osv
osv
PYSEC-2019-11
2019-08-02 15:15:00
Django Denial-of-service in django.utils.text.Truncator
2019-08-06 01:43:29
CVE-2019-14232
2019-08-02 15:15:11
prion
prion
Design/Logic Flaw
2019-08-02 15:15:00
Hardcoded credentials
2023-11-03 05:15:00
cvelist
cvelist
CVE-2019-14232
2019-08-02 00:00:00
CVE-2023-43665
2023-11-03 00:00:00
CVE-2024-27351
2024-03-15 00:00:00
nessus
nessus
openSUSE 15 Security Update : python-Django1 (openSUSE-SU-2023:0389-1)
2023-12-05 00:00:00
Debian DLA-1872-1 : python-django security update
2019-08-12 00:00:00
openSUSE 15 Security Update : python-Django1 (openSUSE-SU-2023:0390-1)
2023-12-05 00:00:00
openvas
openvas
Django < 3.2.22, 4.1.x < 4.1.12, 4.2.x < 4.2.6 DoS Vulnerability - Windows
2023-10-05 00:00:00
Debian: Security Advisory (DLA-1872-1)
2019-08-07 00:00:00
Django < 3.2.22, 4.1.x < 4.1.12, 4.2.x < 4.2.6 DoS Vulnerability - Linux
2023-10-05 00:00:00
debian
debian
[SECURITY] [DLA 1872-1] python-django security update
2019-08-06 10:07:39
[SECURITY] [DSA 4498-1] python-django security update
2019-08-12 09:07:57
[SECURITY] [DSA 4498-1] python-django security update
2019-08-12 09:07:57
github
github
Django Denial-of-service in django.utils.text.Truncator
2023-11-03 06:36:30
Regular expression denial-of-service in Django
2024-03-15 21:30:43
hackerone
hackerone
Internet Bug Bounty: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
2024-03-05 10:53:54
archlinux
archlinux
[ASA-201908-3] python2-django: multiple issues
2019-08-05 00:00:00
[ASA-201908-2] python-django: multiple issues
2019-08-05 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package python3-module-django version 2.2.4-alt1
2019-08-05 00:00:00
Security fix for the ALT Linux 10 package python3-module-django version 2.2.4-alt1
2019-08-05 00:00:00
ubuntu
ubuntu
Django vulnerabilities
2019-08-01 00:00:00
freebsd
freebsd
Django -- multiple vulnerabilities
2019-08-01 00:00:00
redhat
redhat
(RHSA-2020:1324) Moderate: python-django security update
2020-04-06 08:39:12
(RHSA-2020:4390) Moderate: python-django security update
2020-10-28 17:42:01
fedora
fedora
[SECURITY] Fedora 30 Update: python-django-2.1.11-1.fc30
2019-08-15 18:10:42
[SECURITY] Fedora 31 Update: python-django-2.2.13-1.fc31
2020-06-19 01:07:50
suse
suse
Security update for python-Django (moderate)
2019-08-14 00:00:00
Security update for python-Django (moderate)
2019-08-08 00:00:00
gentoo
gentoo
Django: Multiple vulnerabilities
2020-04-30 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.029 Low

EPSS

Percentile

90.8%

JSON
Related for GHSA-C4QH-4VGV-QC6G
vulnrichment1alpinelinux3nvd3debiancve3redhatcve1veracode1cve3ubuntucve3osv12prion2cvelist3nessus18openvas10debian3github2hackerone1archlinux2altlinux2ubuntu1freebsd1redhat2fedora2suse2gentoo1