Denial of Service Vulnerability in Python-Django: CVE-2023-41164
Summary
UBUNTU-CVE-2023-41164: In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode cha... Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features including an ORM, routing, templating, and security mechanisms. However, certain versions of Django are vulnerable to a Denial of Service (DoS) attack due to improper handling of Unicode characters in the uri_to_iri() function.
Vulnerability Detail
In Django versions 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, the function django.utils.encoding.uri_to_iri() is susceptible to a potential Denial of Service (DoS) attack. This vulnerability arises from the function's inability to handle inputs containing a very large number of Unicode characters, which can lead to excessive resource consumption and potentially crash the application. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the input size for the uri_to_iri() function to prevent excessive Unicode characters from being processed. Implement input validation in your application to restrict the number of characters accepted.
Conclusion
CVE-2023-41164 represents a significant vulnerability in certain versions of Python-Django, exposing applications to potential Denial of Service attacks. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for python-django →
FAQ
CVE-2023-41164 is a vulnerability in Django that allows for a Denial of Service (DoS) attack through the improper handling of Unicode characters in the uri_to_iri() function.
The affected versions include Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Django immediately, implement input validation to limit the number of Unicode characters processed by the uri_to_iri() function as a temporary workaround.
The CVSS score of CVE-2023-41164 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
