CVE-2019-14232: Input Validation
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which were thus vulnerable.
Other sources
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which were thus vulnerable.
If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the :tfilter:truncatecharshtml and :tfilter:truncatewordshtml template filters, which were thus vulnerable.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 0:1.11.27-1.el7 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 0:2.1.11-1.el8 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 1.11.23 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 2.1.11 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 2.2.4 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.2.4 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.1.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.11.23 - Upgrade
Upgrade
alpine/py-djangoto a version that resolves this vulnerability.Fixed in 1.11.23-r0 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 1.11.23-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-14232?
CVE-2019-14232 is a vulnerability in Django versions 1.11.x, 2.1.x, and 2.2.x.
How severe is CVE-2019-14232?
CVE-2019-14232 has a severity score of 7.5 (High).
Which versions of Django are affected by CVE-2019-14232?
Django versions 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4 are affected by CVE-2019-14232.
How can I fix CVE-2019-14232?
To fix CVE-2019-14232, upgrade to Django version 1.11.23, 2.1.11, or 2.2.4.
Where can I find more information about CVE-2019-14232?
You can find more information about CVE-2019-14232 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2019-14232), the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2019-14232), the Django website (https://www.djangoproject.com/weblog/2019/aug/01/security-releases/), and the Red Hat Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1734405).