Python/django/4.1.11
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
https://pypi.org/project/django
BSD-3-Clause
AND
BSD
2 Security Vulnerabilities
Django Denial-of-service in django.utils.text.Truncator
Published date: 2023-11-03T06:36:30Z
CVE: CVE-2023-43665
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2023-43665
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2023/oct/04/security-releases/
- https://github.com/django/django/commit/be9c27c4d18c2e6a5be8af4e53c0797440794473
- https://github.com/django/django/commit/c7b7024742250414e426ad49fb80db943e7ba4e8
- https://github.com/django/django/commit/ccdade1a0262537868d7ca64374de3d957ca50c5
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-226.yaml
- https://github.com/advisories/GHSA-h8gc-pgj2-vjm3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
- https://docs.djangoproject.com/en/4.2/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
- https://security.netapp.com/advisory/ntap-20231221-0001
- https://www.djangoproject.com/weblog/2023/oct/04/security-releases
- http://www.openwall.com/lists/oss-security/2024/03/04/1
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
Affected versions:
["4.2", "4.2.1", "4.2.2", "4.2.3", "4.2.4", "4.2.5", "4.1", "4.1.1", "4.1.2", "4.1.3", "4.1.4", "4.1.5", "4.1.6", "4.1.7", "4.1.8", "4.1.9", "4.1.10", "4.1.11", "3.2", "3.2.1", "3.2.2", "3.2.3", "3.2.4", "3.2.5", "3.2.6", "3.2.7", "3.2.8", "3.2.9", "3.2.10", "3.2.11", "3.2.12", "3.2.13", "3.2.14", "3.2.15", "3.2.16", "3.2.17", "3.2.18", "3.2.19", "3.2.20", "3.2.21"]
Secure versions:
[2.2.27, 2.2.28, 3.0a1, 3.1.12, 3.1.13, 3.1.14, 3.2.25, 4.1.13, 4.2.17, 4.2.18, 4.2.19, 4.2.20, 4.2.21, 4.2.22, 4.2.23, 4.2a1, 4.2b1, 4.2rc1, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0a1, 5.0b1, 5.0rc1, 5.1.10, 5.1.11, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.1.9, 5.1a1, 5.1b1, 5.1rc1, 5.2, 5.2.1, 5.2.2, 5.2.3, 5.2a1, 5.2b1, 5.2rc1]
Recommendation:
Update to version 5.2.3.
Django potential denial of service vulnerability in UsernameField on Windows
Published date: 2023-11-02T06:30:25Z
CVE: CVE-2023-46695
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2023-46695
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2023/nov/01/security-releases/
- https://github.com/django/django/commit/048a9ebb6ea468426cb4e57c71572cbbd975517f
- https://github.com/django/django/commit/4965bfdde2e5a5c883685019e57d123a3368a75e
- https://github.com/django/django/commit/f9a7fb8466a7ba4857eaf930099b5258f3eafb2b
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-222.yaml
- https://github.com/advisories/GHSA-qmf9-6jqf-j8fq
- https://groups.google.com/forum/#%21forum/django-announce
- https://security.netapp.com/advisory/ntap-20231214-0001/
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
Affected versions:
["4.2", "4.2.1", "4.2.2", "4.2.3", "4.2.4", "4.2.5", "4.2.6", "4.1", "4.1.1", "4.1.2", "4.1.3", "4.1.4", "4.1.5", "4.1.6", "4.1.7", "4.1.8", "4.1.9", "4.1.10", "4.1.11", "4.1.12", "3.2", "3.2.1", "3.2.2", "3.2.3", "3.2.4", "3.2.5", "3.2.6", "3.2.7", "3.2.8", "3.2.9", "3.2.10", "3.2.11", "3.2.12", "3.2.13", "3.2.14", "3.2.15", "3.2.16", "3.2.17", "3.2.18", "3.2.19", "3.2.20", "3.2.21", "3.2.22"]
Secure versions:
[2.2.27, 2.2.28, 3.0a1, 3.1.12, 3.1.13, 3.1.14, 3.2.25, 4.1.13, 4.2.17, 4.2.18, 4.2.19, 4.2.20, 4.2.21, 4.2.22, 4.2.23, 4.2a1, 4.2b1, 4.2rc1, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0a1, 5.0b1, 5.0rc1, 5.1.10, 5.1.11, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.1.9, 5.1a1, 5.1b1, 5.1rc1, 5.2, 5.2.1, 5.2.2, 5.2.3, 5.2a1, 5.2b1, 5.2rc1]
Recommendation:
Update to version 5.2.3.
400 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 1.5.1 | BSD | 16 | 2013-03-28 - 20:57 | over 12 years |
| 1.5 | BSD | 16 | 2013-02-26 - 19:30 | over 12 years |
| 1.4.22 | BSD | 10 | 2015-08-18 - 17:22 | almost 10 years |
| 1.4.21 | BSD | 11 | 2015-07-08 - 19:56 | almost 10 years |
| 1.4.20 | BSD | 13 | 2015-03-19 - 00:03 | over 10 years |
| 1.4.19 | BSD | 13 | 2015-01-27 - 17:11 | over 10 years |
| 1.4.18 | BSD | 13 | 2015-01-13 - 18:54 | over 10 years |
| 1.4.17 | BSD | 16 | 2015-01-03 - 02:20 | over 10 years |
| 1.4.16 | BSD | 16 | 2014-10-22 - 16:37 | over 10 years |
| 1.4.15 | BSD | 16 | 2014-09-02 - 20:44 | almost 11 years |
| 1.4.14 | BSD | 16 | 2014-08-20 - 20:01 | almost 11 years |
| 1.4.13 | BSD | 19 | 2014-05-14 - 18:27 | about 11 years |
| 1.4.12 | BSD | 21 | 2014-04-28 - 20:30 | about 11 years |
| 1.4.11 | BSD | 21 | 2014-04-21 - 22:40 | about 11 years |
| 1.4.10 | BSD | 23 | 2013-11-06 - 14:21 | over 11 years |
| 1.4.9 | BSD | 23 | 2013-10-25 - 04:38 | over 11 years |
| 1.4.8 | BSD | 23 | 2013-09-15 - 06:22 | almost 12 years |
| 1.4.7 | BSD | 24 | 2013-09-11 - 01:18 | almost 12 years |
| 1.4.6 | BSD | 25 | 2013-08-13 - 16:52 | almost 12 years |
| 1.4.5 | BSD | 26 | 2013-02-20 - 19:54 | over 12 years |
| 1.4.4 | BSD | 26 | 2013-02-19 - 20:27 | over 12 years |
| 1.4.3 | BSD | 28 | 2012-12-10 - 21:46 | over 12 years |
| 1.4.2 | BSD | 28 | 2012-10-17 - 22:18 | over 12 years |
| 1.4.1 | BSD | 29 | 2012-07-30 - 22:48 | almost 13 years |
| 1.4 | BSD | 30 | 2012-03-23 - 18:00 | over 13 years |
| 1.3.7 | BSD | 20 | 2013-02-20 - 20:03 | over 12 years |
| 1.3.6 | BSD | 20 | 2013-02-19 - 20:32 | over 12 years |
| 1.3.5 | BSD | 22 | 2012-12-10 - 21:39 | over 12 years |
| 1.3.4 | BSD | 22 | 2013-03-05 - 22:33 | over 12 years |
| 1.3.3 | BSD | 23 | 2012-08-01 - 22:08 | almost 13 years |
| 1.3.2 | BSD | 23 | 2012-07-30 - 23:02 | almost 13 years |
| 1.3.1 | BSD | 25 | 2011-09-10 - 03:36 | almost 14 years |
| 1.3 | BSD | 28 | 2011-03-23 - 06:09 | over 14 years |
| 1.2.7 | BSD | 22 | 2011-09-11 - 03:05 | almost 14 years |
| 1.2.6 | BSD | 26 | 2011-09-10 - 03:42 | almost 14 years |
| 1.2.5 | BSD | 26 | 2011-02-09 - 04:08 | over 14 years |
| 1.2.4 | BSD | 29 | 2010-12-23 - 05:15 | over 14 years |
| 1.2.3 | BSD | 29 | 2010-09-11 - 08:50 | almost 15 years |
| 1.2.2 | BSD | 29 | 2010-09-09 - 02:41 | almost 15 years |
| 1.2.1 | BSD | 30 | 2010-05-24 - 21:19 | about 15 years |
| 1.2 | BSD | 30 | 2010-05-17 - 20:04 | about 15 years |
| 1.1.4 | BSD | 24 | 2011-02-09 - 04:13 | over 14 years |
| 1.1.3 | BSD | 27 | 2010-12-23 - 05:14 | over 14 years |
| 1.1.2 | BSD | 29 | 1970-01-01 - 00:00 | over 55 years |
| 1.1.1 | BSD | 29 | 1970-01-01 - 00:00 | over 55 years |
| 1.1 | BSD | 29 | 1970-01-01 - 00:00 | over 55 years |
| 1.0.4 | BSD | 26 | 1970-01-01 - 00:00 | over 55 years |
| 1.0.3 | BSD | 26 | 1970-01-01 - 00:00 | over 55 years |
| 1.0.2 | BSD | 26 | 1970-01-01 - 00:00 | over 55 years |
| 1.0.1 | BSD | 26 | 1970-01-01 - 00:00 | over 55 years |