CVE-2019-14235

Se detectó un problema en Django versiones 1.11.x anteriores a 1.11.23, versiones 2.1.x anteriores a 2.1.11 y versiones 2.2.x anteriores a 2.2.4. Si pasaron ciertas entradas, django.utils.encoding.uri_to_iri podría conllevar a un uso de la memoria significativo debido a una recursión cuando se codifican por resonancia las secuencias de octetos UTF-8 inválidas.

It was discovered that Django incorrectly handled the Truncator function. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. It was discovered that Django incorrectly handled the strip_tags function. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. It was discovered that Django incorrectly handled certain lookups in the PostgreSQL support. A remote attacker could possibly use this issue to perform SQL injection attacks. Various other issues were also addressed.