Denial of Service Vulnerability in Python-Django: CVE-2023-43665
Summary
UBUNTU-CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via c... Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an ORM, routing, and templating. The framework is designed to help developers create secure and maintainable web applications. However, a recent vulnerability has been identified that affects certain methods in Django's text utilities, potentially leading to denial of service attacks.
Vulnerability Detail
In Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the methods django.utils.text.Truncator chars() and words() can be exploited when used with html=True. This vulnerability allows an attacker to craft inputs with excessively long and malformed HTML text, which can lead to a denial of service (DoS) condition. This issue arises from an incomplete fix for a previous vulnerability (CVE-2019-14232), making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the html=True parameter in the chars() and words() methods until you can update to the patched version. This will mitigate the risk of a denial of service attack while you prepare for the update.
Conclusion
The CVE-2023-43665 vulnerability in Python-Django poses a significant risk of denial of service attacks through specific methods. It is crucial for users to update their installations to the patched versions to mitigate this risk. By following the provided steps, users can ensure their applications remain secure.
See every vulnerability recorded for python-django →
FAQ
CVE-2023-43665 is a vulnerability in Python-Django that can lead to denial of service attacks through certain methods when handling malformed HTML inputs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6 are affected by this vulnerability.
The CVSS score of CVE-2023-43665 is 7.5, indicating a high severity level.
No subscription is required to access the fix for this vulnerability; it is available for all users.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
