CVE-2019-14232
Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Se detectó un problema en Django versiones 1.11.x anteriores a 1.11.23, versiones 2.1.x anteriores a 2.1.11 y versiones 2.2.x anteriores a 2.2.4. Si los métodos chars() y words() de django.utils.text.Truncator pasaron el argumento html=True, fueron extremadamente lentos para evaluar ciertas entradas debido a una vulnerabilidad de retroceso catastrófico en una expresión regular. Los métodos chars() y words() se usan para implementar los filtros de plantilla truncatechars_html y truncatewords_html, que eran por lo tanto vulnerables.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2019-07-22 CVE Reserved
- 2019-08-01 CVE Published
- 2024-07-26 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (14)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://docs.djangoproject.com/en/dev/releases/security | 2024-07-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | >= 1.11 < 1.11.23 Search vendor "Djangoproject" for product "Django" and version " >= 1.11 < 1.11.23" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | >= 2.1 < 2.1.11 Search vendor "Djangoproject" for product "Django" and version " >= 2.1 < 2.1.11" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | >= 2.2 < 2.2.4 Search vendor "Djangoproject" for product "Django" and version " >= 2.2 < 2.2.4" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.1 Search vendor "Opensuse" for product "Leap" and version "15.1" | - |
Affected
| ||||||