Django Package Vulnerability: Regular Expression Denial-of-Service Risk
Summary
UBUNTU-CVE-2024-27351: In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expressi... Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, and templating. However, certain versions of Django are vulnerable to a regular expression denial-of-service (ReDoS) attack, specifically in the truncation methods that handle HTML content.
Vulnerability Detail
In Django versions 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are susceptible to a potential regular expression denial-of-service attack via a crafted string. This vulnerability arises from an incomplete fix for CVE-2019-14232 and CVE-2023-43665, allowing attackers to exploit the regex processing to consume excessive resources, potentially leading to service disruption.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the HTML truncation feature in your application until the update can be applied. This can be done by avoiding the use of the truncatewords_html filter in your templates.
Conclusion
The vulnerability in Django poses a significant risk due to the potential for denial-of-service attacks through crafted input. It is crucial for developers to update their Django installations to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python-django →
FAQ
A ReDoS attack exploits the way regular expressions are processed, causing the application to consume excessive CPU resources, which can lead to slowdowns or crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Django versions 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3 are affected by this vulnerability.
If you cannot update immediately, consider disabling the HTML truncation feature in your application as a temporary workaround.
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
