Denial of Service Vulnerability in Django - CVE-2023-41164
Summary
CVE-2023-41164: In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode cha... Affects python-django across 2 version ranges.
< 2:2.2.28-1~deb11u7
>= b6475d7d7940f3ce575e0b0f2d83e517f899b4cf, < fd0ccd7fb3ec8aee9a88ab0576059c7393397c8d
Fixed in 2:2.2.28-1~deb11u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and comes with a plethora of features including an ORM, authentication, and an admin interface. The vulnerability CVE-2023-41164 affects multiple versions of Django, specifically versions 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, making it susceptible to denial of service attacks under certain conditions.
Vulnerability Detail
The vulnerability arises from the function django.utils.encoding.uri_to_iri(), which is susceptible to a denial of service (DoS) attack when processing inputs containing a very large number of Unicode characters. An attacker could exploit this vulnerability by sending crafted requests that could lead to excessive resource consumption, potentially causing the application to become unresponsive.
How To Fix
Minimum fixed version
2:2.2.28-1~deb11u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to limit the number of Unicode characters accepted by the uri_to_iri() function. This can help mitigate the risk of DoS attacks until the package is updated.
Conclusion
CVE-2023-41164 is a significant vulnerability in Django that can lead to denial of service attacks. It is crucial for users of affected versions to update their installations promptly to mitigate potential risks. Implementing input validation can serve as a temporary workaround until an update is applied.
See every vulnerability recorded for python-django →
FAQ
CVE-2023-41164 is a vulnerability in Django that allows for potential denial of service attacks via the uri_to_iri() function when processing certain inputs.
The affected versions are Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2023-41164 is 7.5, indicating a high severity level.
If immediate updates are not possible, implement input validation to limit the number of Unicode characters processed by the uri_to_iri() function as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
