Bug 2241046 (CVE-2023-43665)

Summary:	CVE-2023-43665 python-django: Denial-of-service possibility in django.utils.text.Truncator
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, apevec, bbuckingham, bcourt, caswilli, davidn, eglynn, ehelms, epacific, gtanzill, jcammara, jhardy, jjoyce, jmitchel, jneedle, jobarker, jschluet, jsherril, jtanner, kaycoth, kshier, lhh, luizcosta, lzap, mabashia, mburns, mgarciac, mhulan, mminar, nmoumoul, nweather, orabin, pcreech, pgrist, rbiba, rbobbitt, rchan, rhos-maint, security-response-team, simaishi, smcdonal, sskracic, stcannon, teagle, tfister, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-django 3.2.22, python-django 4.1.12, python-django 4.2.6	Doc Type:	If docs needed, set a value
Doc Text:	An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given certain HTML inputs.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2241167, 2241190, 2241251, 2241253, 2241254, 2241255, 2242180, 2242181, 2242182, 2242395, 2242508
Bug Blocks:	2241050

Description Guilherme de Almeida Suckevicz 2023-09-27 20:01:46 UTC

Following the fix for CVE-2019-14232, the regular expressions used in the implementation of django.utils.text.Truncator’s chars() and words() methods (with html=True) were revised and improved. However, these regular expressions still exhibited linear backtracking complexity, so when given a very long, potentially malformed HTML input, the evaluation would still be slow, leading to a potential denial of service vulnerability.

The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus also vulnerable.

The input processed by Truncator, when operating in HTML mode, has been limited to the first five million characters in order to avoid potential performance and memory issues.

Comment 5 Guilherme de Almeida Suckevicz 2023-10-04 19:38:30 UTC

Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 2242182]


Created python-django3 tracking bugs for this issue:

Affects: epel-8 [bug 2242180]
Affects: fedora-all [bug 2242181]

Comment 7 errata-xmlrpc 2023-10-16 15:36:06 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2023:5758 https://access.redhat.com/errata/RHSA-2023:5758

Comment 9 errata-xmlrpc 2023-10-30 01:19:32 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2023:6158 https://access.redhat.com/errata/RHSA-2023:6158

Comment 12 errata-xmlrpc 2024-03-27 13:18:49 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.14 for RHEL 8

Via RHSA-2024:1536 https://access.redhat.com/errata/RHSA-2024:1536

Comment 13 errata-xmlrpc 2024-04-18 01:51:48 UTC

This issue has been addressed in the following products:

  RHUI 4 for RHEL 8

Via RHSA-2024:1878 https://access.redhat.com/errata/RHSA-2024:1878

Comment 14 errata-xmlrpc 2024-04-23 17:14:53 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.15 for RHEL 8

Via RHSA-2024:2010 https://access.redhat.com/errata/RHSA-2024:2010