Denial of Service Vulnerability in Django Package - CVE-2023-43665
Summary
CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via c... Affects python-django across 2 version ranges.
< 2:2.2.28-1~deb11u7
>= b6475d7d7940f3ce575e0b0f2d83e517f899b4cf, < 3106e94e52a0a7786d49803c86b3139df113d36d
Fixed in 2:2.2.28-1~deb11u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features including an ORM, routing, and templating. The framework's functionality includes the ability to truncate text for display purposes, which is where the vulnerability arises. The affected methods, chars() and words(), are used to truncate potentially long HTML text, making them susceptible to denial of service attacks when handling malformed inputs.
Vulnerability Detail
In Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator methods chars() and words() are vulnerable to denial of service (DoS) attacks. This vulnerability is triggered when these methods are used with the html=True parameter and certain inputs containing very long, malformed HTML text. The issue stems from an incomplete fix for a previous vulnerability (CVE-2019-14232), allowing attackers to exploit the truncation methods to consume excessive resources, potentially leading to application downtime.
How To Fix
Minimum fixed version
2:2.2.28-1~deb11u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the chars() and words() methods with the html=True parameter until you can upgrade to a secure version of Django. Instead, consider using plain text truncation methods or sanitize the input HTML to prevent excessively long strings.
Conclusion
CVE-2023-43665 presents a significant risk to applications using vulnerable versions of Django. It is crucial to upgrade to the latest secure versions to mitigate the risk of denial of service attacks. Implementing the recommended fixes and workarounds will help protect your application from potential exploitation.
See every vulnerability recorded for python-django →
FAQ
CVE-2023-43665 is a vulnerability in Django that allows for potential denial of service attacks through the chars() and words() methods when handling malformed HTML.
Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If you cannot upgrade immediately, avoid using the vulnerable methods with html=True and sanitize your input to prevent long strings.
The CVSS score of CVE-2023-43665 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
