Critical ReDoS Vulnerability in Python-Django Package: CVE-2023-36053
Summary
UBUNTU-CVE-2023-36053: In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name la... Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers features such as an ORM, URL routing, and an admin interface. However, certain versions of Python-Django are vulnerable to a ReDoS attack, which can severely impact application performance and availability.
Vulnerability Detail
In Django versions 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, the EmailValidator and URLValidator components are susceptible to a potential ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises from the handling of a large number of domain name labels in emails and URLs, which can lead to excessive resource consumption and application downtime. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation to restrict the length and format of email addresses and URLs processed by your application. This can help mitigate the risk of a ReDoS attack.
Conclusion
The CVE-2023-36053 vulnerability in Python-Django poses a significant risk to applications using affected versions. It is crucial for developers and system administrators to update their packages promptly and consider implementing workarounds to protect their applications from potential ReDoS attacks.
See every vulnerability recorded for python-django →
FAQ
CVE-2023-36053 is a vulnerability in certain versions of the Python-Django package that allows for a ReDoS attack through EmailValidator and URLValidator.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
A ReDoS attack can lead to significant performance degradation, application unavailability, and potential denial of service to legitimate users.
Yes, patched versions of Python-Django are available. Users should update to the latest version to mitigate the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
