Django up to 3.2.21/4.1.11/4.2.5 django.utils.text.Truncator denial of service

Summaryinfo

A vulnerability categorized as problematic has been discovered in Django up to 3.2.21/4.1.11/4.2.5. Impacted is the function django.utils.text.Truncator. Executing a manipulation can lead to denial of service. This vulnerability is tracked as CVE-2023-43665. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Django up to 3.2.21/4.1.11/4.2.5 (Content Management System) and classified as problematic. This vulnerability affects the function django.utils.text.Truncator. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability.

The weakness was disclosed 10/04/2023. The advisory is shared for download at seclists.org. This vulnerability was named CVE-2023-43665 since 09/20/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 238025 (Debian dla-4210 : python-django-doc - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.2.22, 4.1.12 or 4.2.6 eliminates this vulnerability. The upgrade is hosted for download at djangoproject.com.

The vulnerability is also documented in the databases at Tenable (238025) and CERT Bund (WID-SEC-2024-0949). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Fedora Linux
• Red Hat Enterprise Linux
• Red Hat Satellite
• IBM MQ

Productinfo

Type

• Content Management System

Name

• Django

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.2.8
• 3.2.9
• 3.2.10
• 3.2.11
• 3.2.12
• 3.2.13
• 3.2.14
• 3.2.15
• 3.2.16
• 3.2.17
• 3.2.18
• 3.2.19
• 3.2.20
• 3.2.21
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.1.10
• 4.1.11
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion