CVE-2019-14232

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2019-11358: Fixed prototype pollution.
• CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)
• CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-14232: Fixed denial-of-service possibility in django.utils.text.Truncator (bsc#1142880).
• CVE-2019-14233: Fixed denial-of-service possibility in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for JSONField/HStoreField (bsc#1142883).
• CVE-2019-14235: Fixed potential memory exhaustion in django.utils.encoding.uri_to_iri() (bsc#1142885).

Non-security issues fixed:

• Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2019-11358: Fixed prototype pollution.
• CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)
• CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-14232: Fixed denial-of-service possibility in django.utils.text.Truncator (bsc#1142880).
• CVE-2019-14233: Fixed denial-of-service possibility in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for JSONField/HStoreField (bsc#1142883).
• CVE-2019-14235: Fixed potential memory exhaustion in django.utils.encoding.uri_to_iri() (bsc#1142885).

Non-security issues fixed:

• Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.

This update was imported from the openSUSE:Leap:15.1:Update update project.

These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

This update for python-Django fixes the following issues:

• CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).
• CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).
• CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).

This update for python-Django to version 1.11.23 fixes the following issues:

• CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).
• CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).
• CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).
• CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).

This update for python-Django1 to version 1.11.23 fixes the following issues:

• CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).
• CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).
• CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).
• CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).

It was discovered that Django incorrectly handled the Truncator function. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. (CVE-2019-14232)

It was discovered that Django incorrectly handled the strip_tags function. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. (CVE-2019-14233)

It was discovered that Django incorrectly handled certain lookups in the PostgreSQL support. A remote attacker could possibly use this issue to perform SQL injection attacks. (CVE-2019-14234)

It was discovered that Django incorrectly handled certain invalid UTF-8 octet sequences. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. (CVE-2019-14235)