CVE-2023-43665: Django - Denial of Service Vulnerability
Summary
CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via c... Affects django across 3 version ranges.
>= 3.2.0, < 3.2.22
>= 4.1.0, < 4.1.12
>= 4.2.0, < 4.2.6
Fixed in 3.2.22, 4.1.12 or 4.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- python-django · Debian:11
- django · PyPI
The same CVE-2023-43665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular open-source web framework written in Python. It provides a set of tools and libraries for building web applications efficiently. The Truncator class in Django's utils.text module offers methods like chars() and words() that are used for truncating text. These methods are susceptible to a denial of service (DoS) attack when used with html=True, allowing an attacker to exploit certain inputs with excessively long and potentially malformed HTML text.
Vulnerability Detail
The vulnerability exists in Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6. When the chars() and words() methods are used with html=True, an attacker can craft specially designed inputs to trigger a DoS attack. This can lead to resource exhaustion and disrupt the normal functioning of the application. The truncatechars_html and truncatewords_html template filters, which rely on these methods, are also affected. It's important to note that this vulnerability is a result of an incomplete fix for CVE-2019-14232.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.2.0, < 3.2.223.2.22 -
>= 4.1.0, < 4.1.124.1.12 -
>= 4.2.0, < 4.2.64.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if upgrading Django is not immediately feasible, it is advised to avoid using the chars() and words() methods with html=True. Instead, consider using alternative methods or filters that do not have this vulnerability. By avoiding the use of these specific methods, the risk of a DoS attack can be mitigated.
Conclusion
The Django framework is vulnerable to a denial of service attack due to a flaw in the Truncator class. Upgrading to the latest secure version of Django is the recommended solution to mitigate this vulnerability. If immediate upgrade is not possible, avoiding the use of specific methods with html=True can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is an open-source web framework written in Python. It provides a set of tools and libraries for building web applications efficiently.
The vulnerability affects Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6.
This vulnerability can be exploited to launch a denial of service (DoS) attack, potentially leading to resource exhaustion and disruption of the application's normal functioning.
Yes, if upgrading Django is not immediately feasible, it is recommended to avoid using the chars() and words() methods with html=True. This can help mitigate the risk of a DoS attack.
Yes, upgrading Django to version 3.2.22, 4.1.12, or 4.2.6 will address this vulnerability by applying the necessary patches.
Related vulnerabilities
Recent vulnerabilities recorded for django.
