Bugzilla – Bug 1215978
VUL-0: CVE-2023-43665: python-Django,python-Django1: Denial-of-service possibility in django.utils.text.Truncator
Last modified: 2023-12-04 20:05:12 UTC
From oss-security: ---- CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator ============================================================================ Following the fix for CVE-2019-14232, the regular expressions used in the implementation of ``django.utils.text.Truncator``’s ``chars()`` and ``words()`` methods (with ``html=True``) were revised and improved. However, these regular expressions still exhibited linear backtracking complexity, so when given a very long, potentially malformed HTML input, the evaluation would still be slow, leading to a potential denial of service vulnerability. The ``chars()`` and ``words()`` methods are used to implement the ``truncatechars_html`` and ``truncatewords_html`` template filters, hich were thus also vulnerable. The input processed by ``Truncator``, when operating in HTML mode, has been limited to the first five million characters in order to avoid potential performance and memory issues. Thanks Wenchao Li of Alibaba Group for the report. This issue has severity "moderate" according to the Django security policy. References: https://www.djangoproject.com/weblog/2023/oct/04/security-releases/ https://www.openwall.com/lists/oss-security/2023/10/04/6 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-43665
This is an autogenerated message for OBS integration: This bug (1215978) was mentioned in https://build.opensuse.org/request/show/1117946 Factory / python-Django
This is an autogenerated message for OBS integration: This bug (1215978) was mentioned in https://build.opensuse.org/request/show/1117998 Backports:SLE-15-SP4 / python-Django https://build.opensuse.org/request/show/1118000 Backports:SLE-15-SP5 / python-Django https://build.opensuse.org/request/show/1118004 Backports:SLE-15-SP4 / python-Django1 https://build.opensuse.org/request/show/1118005 Backports:SLE-15-SP5 / python-Django1
SUSE-SU-2023:4092-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1215978 CVE References: CVE-2023-43665 Sources used: NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2023:0309-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1215978 CVE References: CVE-2023-43665 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): python-Django-2.2.28-bp155.7.6.1
openSUSE-SU-2023:0310-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1215978 CVE References: CVE-2023-43665 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): python-Django-2.2.28-bp154.2.15.1
SUSE-SU-2023:4232-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1215978 CVE References: CVE-2023-43665 Sources used: SUSE OpenStack Cloud Crowbar 8 (src): python-Django-1.11.29-3.54.1 HPE Helion OpenStack 8 (src): python-Django-1.11.29-3.54.1 SUSE OpenStack Cloud 8 (src): python-Django-1.11.29-3.54.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4426-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1215978 CVE References: CVE-2023-43665 Sources used: SUSE OpenStack Cloud 9 (src): python-Django1-1.11.29-3.53.1 SUSE OpenStack Cloud Crowbar 9 (src): python-Django1-1.11.29-3.53.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2023:0390-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1215978 CVE References: CVE-2023-43665 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): python-Django1-1.11.29-bp155.4.6.1
openSUSE-SU-2023:0389-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1215978 CVE References: CVE-2023-43665 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): python-Django1-1.11.29-bp154.2.9.1