CVE-2019-14233: Input Validation
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
Other sources
Due to the behavior of the underlying HTMLParser, :func:django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. The striptags() method is used to implement the corresponding:tfilter:striptags template filter, which was thus also vulnerable.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-14233?
CVE-2019-14233 is a vulnerability in Django versions 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.
What is the severity of CVE-2019-14233?
CVE-2019-14233 has a severity rating of 7.5 (high).
How does CVE-2019-14233 affect Django?
CVE-2019-14233 affects Django by causing the django.utils.html.strip_tags function to be extremely slow in evaluating certain inputs containing large sequences of nested incomplete HTML entities.
What are the affected versions of Django?
The affected versions of Django are 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.
How do I fix CVE-2019-14233?
To fix CVE-2019-14233, upgrade Django to version 1.11.23, 2.1.11, or 2.2.4, depending on the version you are currently using.