Bug 2241046 (CVE-2023-43665) - CVE-2023-43665 python-django: Denial-of-service possibility in django.utils.text.Truncator
Summary: CVE-2023-43665 python-django: Denial-of-service possibility in django.utils.t...
Keywords:
Status: NEW
Alias: CVE-2023-43665
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2241167 2242180 2241190 2241251 2241253 2241254 2241255 2242181 2242182 2242395 2242508
Blocks: 2241050
TreeView+ depends on / blocked
 
Reported: 2023-09-27 20:01 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-04-23 17:14 UTC (History)
48 users (show)

Fixed In Version: python-django 3.2.22, python-django 4.1.12, python-django 4.2.6
Doc Type: If docs needed, set a value
Doc Text:
An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given certain HTML inputs.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:5758 0 None None None 2023-10-16 15:36:08 UTC
Red Hat Product Errata RHSA-2023:6158 0 None None None 2023-10-30 01:19:35 UTC
Red Hat Product Errata RHSA-2024:1536 0 None None None 2024-03-27 13:18:51 UTC
Red Hat Product Errata RHSA-2024:1878 0 None None None 2024-04-18 01:51:51 UTC
Red Hat Product Errata RHSA-2024:2010 0 None None None 2024-04-23 17:14:56 UTC

Description Guilherme de Almeida Suckevicz 2023-09-27 20:01:46 UTC 
Following the fix for CVE-2019-14232, the regular expressions used in the implementation of django.utils.text.Truncator’s chars() and words() methods (with html=True) were revised and improved. However, these regular expressions still exhibited linear backtracking complexity, so when given a very long, potentially malformed HTML input, the evaluation would still be slow, leading to a potential denial of service vulnerability.

The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus also vulnerable.

The input processed by Truncator, when operating in HTML mode, has been limited to the first five million characters in order to avoid potential performance and memory issues.
Comment 5 Guilherme de Almeida Suckevicz 2023-10-04 19:38:30 UTC 
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 2242182]


Created python-django3 tracking bugs for this issue:

Affects: epel-8 [bug 2242180]
Affects: fedora-all [bug 2242181]
Comment 7 errata-xmlrpc 2023-10-16 15:36:06 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2023:5758 https://access.redhat.com/errata/RHSA-2023:5758
Comment 9 errata-xmlrpc 2023-10-30 01:19:32 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2023:6158 https://access.redhat.com/errata/RHSA-2023:6158
Comment 12 errata-xmlrpc 2024-03-27 13:18:49 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.14 for RHEL 8

Via RHSA-2024:1536 https://access.redhat.com/errata/RHSA-2024:1536
Comment 13 errata-xmlrpc 2024-04-18 01:51:48 UTC 
This issue has been addressed in the following products:

  RHUI 4 for RHEL 8

Via RHSA-2024:1878 https://access.redhat.com/errata/RHSA-2024:1878
Comment 14 errata-xmlrpc 2024-04-23 17:14:53 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.15 for RHEL 8

Via RHSA-2024:2010 https://access.redhat.com/errata/RHSA-2024:2010
Note You need to log in before you can comment on or make changes to this bug.