Catastrophic Backtracking Vulnerability in Django Package - CVE-2019-14232
Summary
UBUNTU-CVE-2019-14232: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, templating, and security features. The vulnerability in question affects Django versions 1.11.x prior to 1.11.23, 2.1.x prior to 2.1.11, and 2.2.x prior to 2.2.4, specifically in the methods used for truncating text in HTML, which can lead to performance issues under certain conditions.
Vulnerability Detail
An issue was discovered in Django's text truncation methods, specifically 'chars()' and 'words()' when passed the 'html=True' argument. This leads to catastrophic backtracking in a regular expression, causing the methods to evaluate extremely slowly for certain inputs. This vulnerability can be exploited to degrade application performance significantly, potentially leading to denial of service conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the 'html=True' argument in the 'chars()' and 'words()' methods until the package is updated. This can help mitigate the performance issues while a permanent fix is being applied.
Conclusion
In summary, CVE-2019-14232 is a significant vulnerability in the Django package that can lead to severe performance issues. It is crucial for users to update to the patched versions to mitigate the risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-django →
FAQ
CVE-2019-14232 is a vulnerability in Django that affects text truncation methods, leading to performance degradation due to catastrophic backtracking in regular expressions.
Django versions 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If you cannot update Django immediately, avoid using the 'html=True' argument in the truncation methods as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
