Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-VM8Q-M57G-PFF3
HistoryMar 15, 2024 - 9:30 p.m.

Regular expression denial-of-service in Django

2024-03-1521:30:43
CWE-1333
GitHub Advisory Database
github.com
13
django
security
denial-of-service

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.7 Medium

AI Score

Confidence

Low

0.029 Low

EPSS

Percentile

90.8%

JSON

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Affected configurations

Vulners
Node
django-registration_projectdjango-registrationRange<5.0.3django
OR
django-registration_projectdjango-registrationRange<4.2.11django
OR
django-registration_projectdjango-registrationRange<3.2.25django
CPENameOperatorVersion
djangolt5.0.3
djangolt4.2.11
djangolt3.2.25

References

Related

ubuntucve 3
osv 16
debiancve 3
cve 3
alpinelinux 3
nvd 3
hackerone 1
cvelist 3
nessus 34
openvas 25
prion 2
github 2
ubuntu 5
fedora 10
ibm 3
wolfi 1
vulnrichment 1
cgr 1
freebsd 3
redhatcve 3
veracode 3
redos 1
mageia 1
debian 3
redhat 8
archlinux 2
altlinux 2
suse 2
gentoo 1
ubuntucve
ubuntucve
CVE-2024-27351
2024-03-04 00:00:00
CVE-2023-43665
2023-10-04 00:00:00
CVE-2019-14232
2019-08-01 00:00:00
osv
osv
Regular expression denial-of-service in Django
2024-03-15 21:30:43
BIT-django-2024-27351
2024-07-02 07:16:49
PYSEC-2024-47
2024-03-15 20:15:00
debiancve
debiancve
CVE-2024-27351
2024-03-15 20:15:09
CVE-2023-43665
2023-11-03 05:15:30
CVE-2019-14232
2019-08-02 15:15:11
cve
cve
CVE-2024-27351
2024-03-15 20:15:09
CVE-2023-43665
2023-11-03 05:15:30
CVE-2019-14232
2019-08-02 15:15:11
alpinelinux
alpinelinux
CVE-2024-27351
2024-03-15 20:15:09
CVE-2023-43665
2023-11-03 05:15:30
CVE-2019-14232
2019-08-02 15:15:11
nvd
nvd
CVE-2024-27351
2024-03-15 20:15:09
CVE-2023-43665
2023-11-03 05:15:30
CVE-2019-14232
2019-08-02 15:15:11
hackerone
hackerone
Internet Bug Bounty: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
2024-03-05 10:53:54
cvelist
cvelist
CVE-2024-27351
2024-03-15 00:00:00
CVE-2023-43665
2023-11-03 00:00:00
CVE-2019-14232
2019-08-02 00:00:00
nessus
nessus
Fedora 40 : python-django (2024-5c7fb64c74)
2024-04-29 00:00:00
RHEL 7 : python-django (Unpatched Vulnerability)
2024-05-11 00:00:00
Fedora 39 : python-django (2024-2ec03ca8cb)
2024-04-18 00:00:00
openvas
openvas
Django < 3.2.22, 4.1.x < 4.1.12, 4.2.x < 4.2.6 DoS Vulnerability - Windows
2023-10-05 00:00:00
Django < 3.2.22, 4.1.x < 4.1.12, 4.2.x < 4.2.6 DoS Vulnerability - Linux
2023-10-05 00:00:00
Ubuntu: Security Advisory (USN-6674-1)
2024-03-05 00:00:00
prion
prion
Hardcoded credentials
2023-11-03 05:15:00
Design/Logic Flaw
2019-08-02 15:15:00
github
github
Django Denial-of-service in django.utils.text.Truncator
2023-11-03 06:36:30
Django Denial-of-service in django.utils.text.Truncator
2019-08-06 01:43:29
ubuntu
ubuntu
Django vulnerability
2024-03-04 00:00:00
Django vulnerability
2024-03-04 00:00:00
Django vulnerability
2023-10-04 00:00:00
fedora
fedora
[SECURITY] Fedora 38 Update: python-django3-3.2.25-2.fc38
2024-04-20 02:14:46
[SECURITY] Fedora 39 Update: python-django-4.2.11-2.fc39
2024-04-18 01:12:12
[SECURITY] Fedora 39 Update: python-django-4.2.6-1.fc39
2023-11-03 18:57:22
ibm
ibm
Security Bulletin: Django-3.2.24-py3-none-any.whl is vulnerable to CVE-2024-27351 used in IBM Maximo Application Suite - Edge Data Collector
2024-04-10 10:49:45
Security Bulletin: Denial of service and security restrictions bypass might affect IBM Storage Defender – Resiliency Service
2024-07-03 20:06:48
Security Bulletin: IBM Cloud Pak for Network Automation 2.7.1 addresses multiple existing security vulnerabilities
2024-04-02 10:47:50
wolfi
wolfi
CVE-2024-27351 vulnerabilities
2024-07-05 09:08:40
vulnrichment
vulnrichment
CVE-2019-14232
2019-08-02 00:00:00
cgr
cgr
CVE-2024-27351 vulnerabilities
2024-05-19 03:07:16
freebsd
freebsd
Django -- multiple vulnerabilities
2023-10-01 00:00:00
Django -- multiple vulnerabilities
2024-02-25 00:00:00
Django -- multiple vulnerabilities
2019-08-01 00:00:00
redhatcve
redhatcve
CVE-2023-43665
2023-10-04 19:54:23
CVE-2019-14232
2020-04-08 21:41:20
CVE-2024-27351
2024-03-04 09:32:01
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2019-08-02 09:44:23
Regular Expression Denial Of Service (ReDoS)
2024-03-22 04:01:57
Regular Expression Denial Of Service (ReDoS)
2023-10-30 06:23:22
redos
redos
ROS-20231030-02
2023-10-30 00:00:00
mageia
mageia
Updated python-django package fixes a security vulnerability
2024-03-20 06:35:18
debian
debian
[SECURITY] [DLA 1872-1] python-django security update
2019-08-06 10:07:39
[SECURITY] [DSA 4498-1] python-django security update
2019-08-12 09:07:57
[SECURITY] [DSA 4498-1] python-django security update
2019-08-12 09:07:57
redhat
redhat
(RHSA-2023:6158) Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
2023-10-30 01:15:30
(RHSA-2023:5758) Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
2023-10-16 15:29:02
(RHSA-2020:1324) Moderate: python-django security update
2020-04-06 08:39:12
archlinux
archlinux
[ASA-201908-3] python2-django: multiple issues
2019-08-05 00:00:00
[ASA-201908-2] python-django: multiple issues
2019-08-05 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package python3-module-django version 2.2.4-alt1
2019-08-05 00:00:00
Security fix for the ALT Linux 10 package python3-module-django version 2.2.4-alt1
2019-08-05 00:00:00
suse
suse
Security update for python-Django (moderate)
2019-08-14 00:00:00
Security update for python-Django (moderate)
2019-08-08 00:00:00
gentoo
gentoo
Django: Multiple vulnerabilities
2020-04-30 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.7 Medium

AI Score

Confidence

Low

0.029 Low

EPSS

Percentile

90.8%

JSON
Related for GHSA-VM8Q-M57G-PFF3
ubuntucve3osv16debiancve3cve3alpinelinux3nvd3hackerone1cvelist3nessus34openvas25prion2github2ubuntu5fedora10ibm3wolfi1vulnrichment1cgr1freebsd3redhatcve3veracode3redos1mageia1debian3redhat8archlinux2altlinux2suse2gentoo1