Django Memory Usage Vulnerability - CVE-2019-14235 in py-django and py3-django
Summary
ALPINE-CVE-2019-14235: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Affects py-django versions < 1.11.23-r0. Fixed in 1.11.23-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers features such as an ORM, routing, and templating. The vulnerability in question affects versions of Django prior to 1.11.23, 2.1.11, and 2.2.4, which could lead to excessive memory usage under certain conditions.
Vulnerability Detail
The vulnerability arises from the function django.utils.encoding.uri_to_iri, which can lead to significant memory consumption due to recursion when handling invalid UTF-8 octet sequences. This can be exploited by passing specially crafted inputs, potentially leading to denial of service through resource exhaustion.
How To Fix
Minimum fixed version
1.11.23-r0
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that inputs to the uri_to_iri function are validated and sanitized to prevent invalid UTF-8 sequences from being processed.
Conclusion
The CVE-2019-14235 vulnerability in Django poses a significant risk due to potential memory exhaustion. It is crucial to update to the patched versions of the affected packages to ensure the security and stability of your applications.
See every vulnerability recorded for py-django →
FAQ
CVE-2019-14235 is a vulnerability in Django that can lead to excessive memory usage due to recursion when processing invalid UTF-8 sequences.
Django versions 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, validate and sanitize inputs to the uri_to_iri function to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
