CVE-2024-27351: Django: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewordshtml template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
Other sources
You're receiving this message because you are on the security prenotification list for the Django web framework; information about this list can be found in our security policy [1].
In accordance with that policy, a set of security releases will be issued on Monday, March 4, 2024 around 900 UTC. This message contains descriptions of the issue, descriptions of the changes which will be made to Django, and the patches which will be applied to Django.
django.utils.text.Truncator.words() method (with html=True) and truncatewordshtml template filter were subject to a potential regular expression denial-of-service attack using a suitably crafted string (follow up to CVE-2019-14232 and CVE-2023-43665).
This issue has Moderate severity, according to the Django security policy [1].
Affected versions =================
Django 5.0 Django 4.2 Django 3.2
Resolution ==========
Included with this email are patches implementing the changes described above for each affected version of Django. On the release date, these patches will be applied to the Django development repository and the following releases will be issued along with disclosure of the issues:
Django 5.0.3 Django 4.2.11 Django 3.2.25
[1] https://www.djangoproject.com/security/
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27351?
CVE-2024-27351 has been categorized as a potential denial-of-service vulnerability due to its exploitability via crafted strings in the Django framework.
How do I fix CVE-2024-27351?
To address CVE-2024-27351, upgrade Django to version 5.0.3, 4.2.11, or 3.2.25 or later.
Which Django versions are affected by CVE-2024-27351?
CVE-2024-27351 affects Django versions 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3.
What specific methods are vulnerable in CVE-2024-27351?
CVE-2024-27351 involves a vulnerability in the django.utils.text.Truncator.words() method with html=True and the truncatewords_html template filter.
Is there a known exploit for CVE-2024-27351?
Currently, there are no specific public exploits for CVE-2024-27351, but the potential for a denial-of-service attack exists.