Django up to 3.2.15/4.0.7/4.1.1 URL locale incorrect regex

Summaryinfo

A vulnerability, which was classified as critical, has been found in Django up to 3.2.15/4.0.7/4.1.1. Affected is an unknown function of the component URL Handler. Performing a manipulation of the argument locale results in incorrect regex. This vulnerability was named CVE-2022-41323. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Django up to 3.2.15/4.0.7/4.1.1 (Content Management System). This affects an unknown functionality of the component URL Handler. The manipulation of the argument locale with an unknown input leads to a incorrect regex vulnerability. CWE is classifying the issue as CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. This is going to have an impact on availability. The summary by CVE is:

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

The weakness was presented 10/16/2022 as 5b6b257fa7ec37ff27965358800c67e2dd11c924. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2022-41323 since 09/23/2022. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.2.16, 4.0.8 or 4.1.2 eliminates this vulnerability. Applying the patch 5b6b257fa7ec37ff27965358800c67e2dd11c924 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Django

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.2.8
• 3.2.9
• 3.2.10
• 3.2.11
• 3.2.12
• 3.2.13
• 3.2.14
• 3.2.15
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.1.0
• 4.1.1

License

• open-source

Website

• Product: https://github.com/django/django/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion