CVE-2023-43665: Django: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator
Following the fix for CVE-2019-14232, the regular expressions used in the implementation of django.utils.text.Truncator’s chars() and words() methods (with html=True) were revised and improved. However, these regular expressions still exhibited linear backtracking complexity, so when given a very long, potentially malformed HTML input, the evaluation would still be slow, leading to a potential denial of service vulnerability.
The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which were thus also vulnerable.
The input processed by Truncator, when operating in HTML mode, has been limited to the first five million characters in order to avoid potential performance and memory issues.
Other sources
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
— Ubuntu
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2023-43665.
What is the title of this vulnerability?
The title of this vulnerability is "Django: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator".
What is the description of this vulnerability?
The description of this vulnerability is "Denial-of-service possibility in django.utils.text.Truncator".
What software is affected by this vulnerability?
The affected software is python-django version 4.2.6, 4.1.12, and 3.2.22 on Ubuntu, version 2:2.2.12-1ubuntu0.20 on Ubuntu Focal, version 2:3.2.12-2ubuntu1.9 on Ubuntu Jammy, version 3:3.2.18-1ubuntu0.5 on Ubuntu Lunar, and version 1:1.11.11-1ubuntu1.21+ on Ubuntu Bionic.
How can I fix this vulnerability?
To fix this vulnerability, update your python-django package to the recommended version provided by your operating system vendor or follow the instructions in the official security release from Django.