{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "state": "PUBLISHED", "cveId": "CVE-2019-14232", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-05T00:12:42.892Z", "dateReserved": "2019-07-22T00:00:00", "datePublished": "2019-08-02T00:00:00" }, "containers": { "cna": { "providerMetadata": { "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-01T17:09:49.299848" }, "descriptions": [ { "lang": "en", "value": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable." } ], "affected": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "references": [ { "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "url": "https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs" }, { "url": "https://www.djangoproject.com/weblog/2019/aug/01/security-releases/" }, { "name": "openSUSE-SU-2019:1839", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html" }, { "name": "20190812 [SECURITY] [DSA 4498-1] python-django security update", "tags": [ "mailing-list" ], "url": "https://seclists.org/bugtraq/2019/Aug/15" }, { "name": "DSA-4498", "tags": [ "vendor-advisory" ], "url": "https://www.debian.org/security/2019/dsa-4498" }, { "name": "openSUSE-SU-2019:1872", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html" }, { "name": "FEDORA-2019-647f74ce51", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/" }, { "url": "https://security.netapp.com/advisory/ntap-20190828-0002/" }, { "name": "GLSA-202004-17", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/202004-17" }, { "name": "[oss-security] 20231004 Django: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/04/6" }, { "name": "[oss-security] 20240304 Django: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2024/03/04/1" } ], "problemTypes": [ { "descriptions": [ { "type": "text", "lang": "en", "description": "n/a" } ] } ] }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2019-14232", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-02T18:04:48.307144Z" } } } ], "affected": [ { "cpes": [ "cpe:2.3:a:djangoblog_project:djangoblog:*:*:*:*:*:*:*:*" ], "vendor": "djangoblog_project", "product": "djangoblog", "versions": [ { "status": "affected", "version": "1.11.23", "lessThan": "2.2.4", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption" } ] } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:12:01.500Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:12:42.892Z" }, "title": "CVE Program Container", "references": [ { "url": "https://docs.djangoproject.com/en/dev/releases/security/", "tags": [ "x_transferred" ] }, { "url": "https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs", "tags": [ "x_transferred" ] }, { "url": "https://www.djangoproject.com/weblog/2019/aug/01/security-releases/", "tags": [ "x_transferred" ] }, { "name": "openSUSE-SU-2019:1839", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html" }, { "name": "20190812 [SECURITY] [DSA 4498-1] python-django security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/Aug/15" }, { "name": "DSA-4498", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.debian.org/security/2019/dsa-4498" }, { "name": "openSUSE-SU-2019:1872", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html" }, { "name": "FEDORA-2019-647f74ce51", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/" }, { "url": "https://security.netapp.com/advisory/ntap-20190828-0002/", "tags": [ "x_transferred" ] }, { "name": "GLSA-202004-17", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202004-17" }, { "name": "[oss-security] 20231004 Django: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/04/6" }, { "name": "[oss-security] 20240304 Django: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/03/04/1" } ] } ] } }