CVE-2023-43665

Django Denial-of-service in django.utils.text.Truncator

7.5 HighFix available

CVE-2023-43665 is a high vulnerability (CVSS 7.5) in Djangoproject Django, published October 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 74th percentile. Fixed in django 3.2.22.

What does this mean?

Severity: 7.5 HighCVSS 3.1, NVD
Exploit chance: 1.46%EPSS, 74th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 3.2.22django +163 more

Description

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.46%Up 1.4 points since Nov 3, 2023

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`django` PyPI	3.2a1 up to 3.2.22	3.2.22
`django` PyPI	4.1a1 up to 4.1.12	4.1.12
`django` PyPI	4.2a1 up to 4.2.6	4.2.6
`py3-django` Alpine:v3.18	before 4.2.6-r0	4.2.6-r0
`py3-django` Alpine:v3.19	before 4.2.6-r0	4.2.6-r0
`py3-django` Alpine:v3.20	before 4.2.6-r0	4.2.6-r0
`py3-django` Alpine:v3.21	before 4.2.6-r0	4.2.6-r0
`py3-django` Alpine:v3.22	before 4.2.6-r0	4.2.6-r0
`py3-django` Alpine:v3.23	before 4.2.6-r0	4.2.6-r0
`py3-django` Alpine:v3.24	before 4.2.6-r0	4.2.6-r0

Show 154 moreShow less

Affected packages
Package	Affected	Fixed
`django` Bitnami	3.2.0 up to 3.2.22, 4.1.0 up to 4.1.12, 4.2.0 up to 4.2.6	3.2.224.1.124.2.6
`django` TuxCare:PyPI	4.0 up to 4.0.post7+tuxcare, plus listed versions 4.0.post1+tuxcare4.0.post2+tuxcare4.0.post3+tuxcare4.0.post4+tuxcare4.0.post5+tuxcare4.0.post6+tuxcare	4.0.post7+tuxcare
`django` TuxCare:PyPI From an advisory covering 20 CVEs	4.2 up to 4.2.post17+tuxcare, plus listed versions 4.2.post1+tuxcare4.2.post10+tuxcare4.2.post11+tuxcare4.2.post12+tuxcare4.2.post13+tuxcare Show 11 moreShow less 4.2.post14+tuxcare4.2.post15+tuxcare4.2.post16+tuxcare4.2.post2+tuxcare4.2.post3+tuxcare4.2.post4+tuxcare4.2.post5+tuxcare4.2.post6+tuxcare4.2.post7+tuxcare4.2.post8+tuxcare4.2.post9+tuxcare	4.2.post17+tuxcare
`python-django` Debian:12	before 3:3.2.25-0+deb12u1, plus listed versions 3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-13:3.2.20-1.13:3.2.21-1	3:3.2.25-0+deb12u1
`python-django` Debian:13	before 3:4.2.6-1	3:4.2.6-1
`python-django` Debian:14	before 3:4.2.6-1	3:4.2.6-1
`python-django` Debian:11 From an advisory covering 6 CVEs	before 2:2.2.28-1~deb11u7, plus listed versions 2:2.2.24-12:2.2.25-1~deb11u12:2.2.26-1~deb11u12:2.2.28-1~deb11u12:2.2.28-1~deb11u2 Show 4 moreShow less 2:2.2.28-1~deb11u32:2.2.28-1~deb11u42:2.2.28-1~deb11u52:2.2.28-1~deb11u6	2:2.2.28-1~deb11u7
`python-django` Debian:12 From an advisory covering 23 CVEs	before 3:3.2.25-0+deb12u1, plus listed versions 3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-13:3.2.20-1.13:3.2.21-1	3:3.2.25-0+deb12u1
`django` PyPI	3.2a1 up to 3.2.22, plus listed versions 3.23.2.13.2.103.2.113.2.12 Show 19 moreShow less 3.2.133.2.143.2.153.2.163.2.173.2.183.2.193.2.23.2.203.2.213.2.33.2.43.2.53.2.63.2.73.2.83.2.93.2b13.2rc1	3.2.22
`django` PyPI	4.1a1 up to 4.1.12, plus listed versions 4.14.1.14.1.104.1.114.1.2 Show 9 moreShow less 4.1.34.1.44.1.54.1.64.1.74.1.84.1.94.1b14.1rc1	4.1.12
`django` PyPI	4.2a1 up to 4.2.6, plus listed versions 4.24.2.14.2.24.2.34.2.44.2.54.2b14.2rc1	4.2.6
`python-django` openEuler:20.03-LTS-SP1	before 2.2.27-8.oe1	2.2.27-8.oe1
`python-django` openEuler:20.03-LTS-SP3	before 2.2.27-8.oe1	2.2.27-8.oe1
`python-django` openEuler:22.03-LTS	before 3.2.12-7.oe2203sp2	3.2.12-7.oe2203sp2
`python-django` openEuler:22.03-LTS-SP1	before 3.2.12-7.oe2203sp1	3.2.12-7.oe2203sp1
`python-django` openEuler:22.03-LTS-SP2	before 3.2.12-7.oe2203sp2	3.2.12-7.oe2203sp2
`django` PyPI	3.2 up to 3.2.22, 4.1 up to 4.1.12, 4.2 up to 4.2.6, plus listed versions 3.2.13.2.103.2.113.2.123.2.13 Show 32 moreShow less 3.2.143.2.153.2.163.2.173.2.183.2.193.2.23.2.203.2.213.2.33.2.43.2.53.2.63.2.73.2.83.2.94.1.14.1.104.1.114.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.14.2.24.2.34.2.44.2.5	3.2.224.1.124.2.6
`ansible-core` Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 3 CVEs	before 0:2.15.5-1.el8ap	0:2.15.5-1.el8ap
`ansible-core` Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 3 CVEs	before 0:2.15.5-1.el8ap	0:2.15.5-1.el8ap
`ansible-core` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 3 CVEs	before 0:2.15.5-1.el8ap	0:2.15.5-1.el8ap
`ansible-core` Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 3 CVEs	before 0:2.15.5-1.el9ap	0:2.15.5-1.el9ap
`ansible-core` Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 3 CVEs	before 0:2.15.5-1.el9ap	0:2.15.5-1.el9ap
`ansible-core` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 3 CVEs	before 0:2.15.5-1.el9ap	0:2.15.5-1.el9ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 3 CVEs	before 0:4.4.6-1.el8ap	0:4.4.6-1.el8ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 3 CVEs	before 0:4.4.6-1.el9ap	0:4.4.6-1.el9ap
`python39-django` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 3 CVEs	before 0:3.2.22-1.el8ap	0:3.2.22-1.el8ap
`python3x-django` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 3 CVEs	before 0:3.2.22-1.el8ap	0:3.2.22-1.el8ap
`python-django` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 3 CVEs	before 0:3.2.22-1.el9ap	0:3.2.22-1.el9ap
`python3-django` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 3 CVEs	before 0:3.2.22-1.el9ap	0:3.2.22-1.el9ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 2 CVEs	before 0:4.4.7-1.el8ap	0:4.4.7-1.el8ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 2 CVEs	before 0:4.4.7-1.el9ap	0:4.4.7-1.el9ap
`python39-urllib3` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 2 CVEs	before 0:1.26.18-1.el8ap	0:1.26.18-1.el8ap
`python3x-urllib3` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 2 CVEs	before 0:1.26.18-1.el8ap	0:1.26.18-1.el8ap
`python-urllib3` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 2 CVEs	before 0:1.26.18-1.el9ap	0:1.26.18-1.el9ap
`python3-urllib3` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 2 CVEs	before 0:1.26.18-1.el9ap	0:1.26.18-1.el9ap
`python-galaxy-importer` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:0.4.18-2.el8pc	0:0.4.18-2.el8pc
`python39-galaxy-importer` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:0.4.18-2.el8pc	0:0.4.18-2.el8pc
`python-galaxy-importer` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:0.4.18-2.el8pc	0:0.4.18-2.el8pc
`python39-galaxy-importer` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:0.4.18-2.el8pc	0:0.4.18-2.el8pc
`python-django` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:3.2.22-1.el8pc	0:3.2.22-1.el8pc
`python39-django` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:3.2.22-1.el8pc	0:3.2.22-1.el8pc
`python-django` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:3.2.22-1.el8pc	0:3.2.22-1.el8pc
`python39-django` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:3.2.22-1.el8pc	0:3.2.22-1.el8pc
`python-aiohttp` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:3.9.2-0.1.el8pc	0:3.9.2-0.1.el8pc
`python-aiohttp-debugsource` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:3.9.2-0.1.el8pc	0:3.9.2-0.1.el8pc
`python39-aiohttp` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:3.9.2-0.1.el8pc	0:3.9.2-0.1.el8pc
`python39-aiohttp-debuginfo` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:3.9.2-0.1.el8pc	0:3.9.2-0.1.el8pc
`python-aiohttp` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:3.9.2-0.1.el8pc	0:3.9.2-0.1.el8pc
`python-aiohttp-debugsource` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:3.9.2-0.1.el8pc	0:3.9.2-0.1.el8pc
`python39-aiohttp` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:3.9.2-0.1.el8pc	0:3.9.2-0.1.el8pc
`python39-aiohttp-debuginfo` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:3.9.2-0.1.el8pc	0:3.9.2-0.1.el8pc
`python-jinja2` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:3.1.3-0.1.el8pc	0:3.1.3-0.1.el8pc
`python39-jinja2` Red Hat:satellite_capsule:6.14::el8 From an advisory covering 7 CVEs	before 0:3.1.3-0.1.el8pc	0:3.1.3-0.1.el8pc
`python-jinja2` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:3.1.3-0.1.el8pc	0:3.1.3-0.1.el8pc
`python39-jinja2` Red Hat:satellite:6.14::el8 From an advisory covering 7 CVEs	before 0:3.1.3-0.1.el8pc	0:3.1.3-0.1.el8pc
`python-django` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:4.2.11-1.el8ui	0:4.2.11-1.el8ui
`python3.11-django` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:4.2.11-1.el8ui	0:4.2.11-1.el8ui
`python-aiohttp` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:3.9.2-1.el8ui	0:3.9.2-1.el8ui
`python-aiohttp-debugsource` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:3.9.2-1.el8ui	0:3.9.2-1.el8ui
`python3.11-aiohttp-debuginfo` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:3.9.2-1.el8ui	0:3.9.2-1.el8ui
`python3.11-aiohttp` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:3.9.2-1.el8ui	0:3.9.2-1.el8ui
`python-cryptography` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:41.0.6-1.el8ui	0:41.0.6-1.el8ui
`python-cryptography-debugsource` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:41.0.6-1.el8ui	0:41.0.6-1.el8ui
`python3.11-cryptography` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:41.0.6-1.el8ui	0:41.0.6-1.el8ui
`python3.11-cryptography-debuginfo` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:41.0.6-1.el8ui	0:41.0.6-1.el8ui
`python-jinja2` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:3.1.3-1.el8ui	0:3.1.3-1.el8ui
`python3.11-jinja2` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:3.1.3-1.el8ui	0:3.1.3-1.el8ui
`python-ecdsa` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:0.18.0-4.el8ui	0:0.18.0-4.el8ui
`python3.11-ecdsa` Red Hat:rhui:4::el8 From an advisory covering 14 CVEs	before 0:0.18.0-4.el8ui	0:0.18.0-4.el8ui
`python-pygments` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python3.11-pygments` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python-pygments` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python3.11-pygments` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`foreman` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-debug` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman` Red Hat:satellite_utils:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-cli` Red Hat:satellite_utils:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-cli` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-debug` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-dynflow-sidekiq` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-ec2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-journald` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-libvirt` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-openstack` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-ovirt` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-pcp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-postgresql` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-redis` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-service` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-telemetry` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-vmware` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`python-galaxy-importer` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python3.11-galaxy-importer` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python-galaxy-importer` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python3.11-galaxy-importer` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`puppetserver` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:7.14.0-1.el8sat	0:7.14.0-1.el8sat
`puppetserver` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:7.14.0-1.el8sat	0:7.14.0-1.el8sat
`python-aiohttp` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp-debugsource` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp-debuginfo` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`rubygem-activesupport` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:6.1.7.6-1.el8sat	0:6.1.7.6-1.el8sat
`rubygem-activesupport` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.1.7.6-1.el8sat	0:6.1.7.6-1.el8sat
`python-django` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python3.11-django` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python-django` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python3.11-django` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python-pycryptodomex` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex-debugsource` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex-debuginfo` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`rubygem-puma` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-puma-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-puma-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-audited` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:5.4.2-1.el8sat	0:5.4.2-1.el8sat
`python-jinja2` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python3.11-jinja2` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python-jinja2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python3.11-jinja2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python-Django` SUSE:HPE Helion OpenStack 8	before 1.11.29-3.54.1	1.11.29-3.54.1
`python-Django` SUSE:OpenStack Cloud 8	before 1.11.29-3.54.1	1.11.29-3.54.1
`python-Django` SUSE:OpenStack Cloud Crowbar 8	before 1.11.29-3.54.1	1.11.29-3.54.1
`python-Django1` SUSE:OpenStack Cloud 9	before 1.11.29-3.53.1	1.11.29-3.53.1
`python-Django1` SUSE:OpenStack Cloud Crowbar 9	before 1.11.29-3.53.1	1.11.29-3.53.1
`python-django` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.1 Show 30 moreShow less 1.6.1-2ubuntu0.21.6.1-2ubuntu0.31.6.1-2ubuntu0.41.6.1-2ubuntu0.51.6.1-2ubuntu0.61.6.1-2ubuntu0.81.6.1-2ubuntu0.91.6.1-2ubuntu0.101.6.1-2ubuntu0.111.6.1-2ubuntu0.121.6.1-2ubuntu0.131.6.1-2ubuntu0.141.6.1-2ubuntu0.151.6.1-2ubuntu0.161.6.11-0ubuntu11.6.11-0ubuntu1.11.6.11-0ubuntu1.21.6.11-0ubuntu1.31.6.11-0ubuntu1.3+esm11.6.11-0ubuntu1.3+esm21.6.11-0ubuntu1.3+esm31.6.11-0ubuntu1.3+esm41.6.11-0ubuntu1.3+esm51.6.11-0ubuntu1.3+esm61.6.11-0ubuntu1.3+esm71.6.11-0ubuntu1.3+esm81.6.11-0ubuntu1.3+esm91.6.11-0ubuntu1.3+esm101.6.11-0ubuntu1.3+esm111.6.11-0ubuntu1.3+esm12	None known
`python-django` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.7.9-1ubuntu51.8.5-2ubuntu11.8.7-1ubuntu11.8.7-1ubuntu21.8.7-1ubuntu3 Show 28 moreShow less 1.8.7-1ubuntu41.8.7-1ubuntu51.8.7-1ubuntu5.11.8.7-1ubuntu5.21.8.7-1ubuntu5.41.8.7-1ubuntu5.51.8.7-1ubuntu5.61.8.7-1ubuntu5.71.8.7-1ubuntu5.81.8.7-1ubuntu5.91.8.7-1ubuntu5.101.8.7-1ubuntu5.111.8.7-1ubuntu5.121.8.7-1ubuntu5.131.8.7-1ubuntu5.141.8.7-1ubuntu5.151.8.7-1ubuntu5.15+esm11.8.7-1ubuntu5.15+esm31.8.7-1ubuntu5.15+esm41.8.7-1ubuntu5.15+esm51.8.7-1ubuntu5.15+esm61.8.7-1ubuntu5.15+esm71.8.7-1ubuntu5.15+esm81.8.7-1ubuntu5.15+esm91.8.7-1ubuntu5.15+esm101.8.7-1ubuntu5.15+esm111.8.7-1ubuntu5.15+esm121.8.7-1ubuntu5.15+esm13	None known
`python-django` Ubuntu:Pro:18.04:LTS	before 1:1.11.11-1ubuntu1.21+esm2, plus listed versions 1:1.11.4-1ubuntu11:1.11.6-1ubuntu11:1.11.9-1ubuntu11:1.11.11-1ubuntu11:1.11.11-1ubuntu1.1 Show 21 moreShow less 1:1.11.11-1ubuntu1.21:1.11.11-1ubuntu1.31:1.11.11-1ubuntu1.41:1.11.11-1ubuntu1.51:1.11.11-1ubuntu1.61:1.11.11-1ubuntu1.71:1.11.11-1ubuntu1.81:1.11.11-1ubuntu1.91:1.11.11-1ubuntu1.101:1.11.11-1ubuntu1.111:1.11.11-1ubuntu1.121:1.11.11-1ubuntu1.131:1.11.11-1ubuntu1.141:1.11.11-1ubuntu1.151:1.11.11-1ubuntu1.161:1.11.11-1ubuntu1.171:1.11.11-1ubuntu1.181:1.11.11-1ubuntu1.191:1.11.11-1ubuntu1.201:1.11.11-1ubuntu1.211:1.11.11-1ubuntu1.21+esm1	1:1.11.11-1ubuntu1.21+esm2
`python-django` Ubuntu:20.04:LTS	before 2:2.2.12-1ubuntu0.20, plus listed versions 1:1.11.22-1ubuntu12:2.2.6-1ubuntu12:2.2.9-2ubuntu12:2.2.10-12:2.2.10-1ubuntu1 Show 21 moreShow less 2:2.2.11-12:2.2.12-12:2.2.12-1ubuntu0.12:2.2.12-1ubuntu0.22:2.2.12-1ubuntu0.32:2.2.12-1ubuntu0.42:2.2.12-1ubuntu0.52:2.2.12-1ubuntu0.62:2.2.12-1ubuntu0.72:2.2.12-1ubuntu0.82:2.2.12-1ubuntu0.92:2.2.12-1ubuntu0.102:2.2.12-1ubuntu0.112:2.2.12-1ubuntu0.122:2.2.12-1ubuntu0.132:2.2.12-1ubuntu0.142:2.2.12-1ubuntu0.152:2.2.12-1ubuntu0.162:2.2.12-1ubuntu0.172:2.2.12-1ubuntu0.182:2.2.12-1ubuntu0.19	2:2.2.12-1ubuntu0.20
`python-django` Ubuntu:22.04:LTS	before 2:3.2.12-2ubuntu1.9, plus listed versions 2:2.2.24-1ubuntu12:3.2.12-22:3.2.12-2ubuntu12:3.2.12-2ubuntu1.12:3.2.12-2ubuntu1.2 Show 6 moreShow less 2:3.2.12-2ubuntu1.32:3.2.12-2ubuntu1.42:3.2.12-2ubuntu1.52:3.2.12-2ubuntu1.62:3.2.12-2ubuntu1.72:3.2.12-2ubuntu1.8	2:3.2.12-2ubuntu1.9
`python-django` Ubuntu:24.04:LTS	before 3:4.2.4-1ubuntu2	3:4.2.4-1ubuntu2
`python-django` Ubuntu:Pro:18.04:LTS From an advisory covering 2 CVEs	before 1:1.11.11-1ubuntu1.21+esm2, plus listed versions 1:1.11.4-1ubuntu11:1.11.6-1ubuntu11:1.11.9-1ubuntu11:1.11.11-1ubuntu11:1.11.11-1ubuntu1.1 Show 21 moreShow less 1:1.11.11-1ubuntu1.21:1.11.11-1ubuntu1.31:1.11.11-1ubuntu1.41:1.11.11-1ubuntu1.51:1.11.11-1ubuntu1.61:1.11.11-1ubuntu1.71:1.11.11-1ubuntu1.81:1.11.11-1ubuntu1.91:1.11.11-1ubuntu1.101:1.11.11-1ubuntu1.111:1.11.11-1ubuntu1.121:1.11.11-1ubuntu1.131:1.11.11-1ubuntu1.141:1.11.11-1ubuntu1.151:1.11.11-1ubuntu1.161:1.11.11-1ubuntu1.171:1.11.11-1ubuntu1.181:1.11.11-1ubuntu1.191:1.11.11-1ubuntu1.201:1.11.11-1ubuntu1.211:1.11.11-1ubuntu1.21+esm1	1:1.11.11-1ubuntu1.21+esm2
`python-Django` SUSE:Package Hub 15 SP5	before 2.2.28-bp155.7.6.1	2.2.28-bp155.7.6.1
`python-Django` openSUSE:Leap 15.5	before 2.2.28-bp155.7.6.1	2.2.28-bp155.7.6.1
`python-Django` SUSE:Package Hub 15 SP4	before 2.2.28-bp154.2.15.1	2.2.28-bp154.2.15.1
`python-Django` openSUSE:Leap 15.4	before 2.2.28-bp154.2.15.1	2.2.28-bp154.2.15.1
`python-Django1` SUSE:Package Hub 15 SP4	before 1.11.29-bp154.2.9.1	1.11.29-bp154.2.9.1
`python-Django1` openSUSE:Leap 15.4	before 1.11.29-bp154.2.9.1	1.11.29-bp154.2.9.1
`python-Django1` SUSE:Package Hub 15 SP5	before 1.11.29-bp155.4.6.1	1.11.29-bp155.4.6.1
`python-Django1` openSUSE:Leap 15.5	before 1.11.29-bp155.4.6.1	1.11.29-bp155.4.6.1
`python-Django` openSUSE:Tumbleweed	before 4.2.6-1.1	4.2.6-1.1
`python-Django4` openSUSE:Tumbleweed From an advisory covering 51 CVEs	before 4.2.14-1.1	4.2.14-1.1
`python-Django6` openSUSE:Tumbleweed From an advisory covering 70 CVEs	before 6.0-1.1	6.0-1.1
`python-Django4` openSUSE:Tumbleweed From an advisory covering 59 CVEs	before 4.2.30-4.1	4.2.30-4.1
`python-Django` openSUSE:Tumbleweed From an advisory covering 49 CVEs	before 5.2.16-1.1	5.2.16-1.1
`python-Django5` openSUSE:Tumbleweed From an advisory covering 93 CVEs	before 5.2.16-1.1	5.2.16-1.1

What each source reports

NVD Score used7.5

Record: CVE-2023-43665
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-1284
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2023-43665
Updated: 2026-11-02

EUVDEUVD-2023-0070No score

Record: EUVD-2023-0070
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h8gc-pgj2-vjm38.7

Django Denial-of-service in django.utils.text.Truncator

Record: GHSA-h8gc-pgj2-vjm3
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-1284
Updated: 2026-11-02

OSVALPINE-CVE-2023-436657.5

Record: ALPINE-CVE-2023-43665
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVDEBIAN-CVE-2023-436657.5

Record: DEBIAN-CVE-2023-43665
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 27 moreShow less

OSVGHSA-h8gc-pgj2-vjm38.7

Django Denial-of-service in django.utils.text.Truncator

Record: GHSA-h8gc-pgj2-vjm3
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-1284, CWE-400
Updated: 2026-11-02

OSVOESA-2023-17225.3

python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given certain HTML inputs.(CVE-2023-43665)

Record: OESA-2023-1722
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2023:57587.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record: RHSA-2023:5758
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-13

OSVRHSA-2023:61587.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record: RHSA-2023:6158
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:15367.5

Red Hat Security Advisory: Satellite 6.14.3 Async Security Update

Record: RHSA-2024:1536
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-13

OSVRHSA-2024:18787.5

Red Hat Security Advisory: RHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements

Record: RHSA-2024:1878
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-13

OSVRHSA-2024:20107.6

Red Hat Security Advisory: Satellite 6.15.0 release

Record: RHSA-2024:2010
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Updated: 2026-11-13

OSVUBUNTU-CVE-2023-436657.5

Record: UBUNTU-CVE-2023-43665
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-django-2023-43665No score

Record: BIT-django-2023-43665
Updated: 2026-11-02

OSVCLSA-2026-1784164007No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post7+tuxcare.

Record: CLSA-2026-1784164007
Updated: 2026-11-02

OSVCLSA-2026-1792393048No score

TuxCare security update for django (20 CVEs)

TuxCare rebuilt django to address 20 CVEs. Fixed in 4.2.post17+tuxcare.

Record: CLSA-2026-1792393048
Updated: 2026-11-02

OSVNo score

Record: CVE-2023-43665
Updated: 2026-11-02

OSVopenSUSE-SU-2023:0309-1No score

Security update for python-Django

This update for python-Django fixes the following issues:

CVE-2023-43665: Denial-of-service in django.utils.text.Truncator (boo#1215978).

Record: openSUSE-SU-2023:0309-1
Updated: 2026-11-02

OSVopenSUSE-SU-2023:0310-1No score

Security update for python-Django

This update for python-Django fixes the following issues:

CVE-2023-43665: Denial-of-service in django.utils.text.Truncator (boo#1215978).

Record: openSUSE-SU-2023:0310-1
Updated: 2026-11-02

OSVopenSUSE-SU-2023:0389-1No score

Security update for python-Django1

This update for python-Django1 fixes the following issues:

CVE-2023-43665: Fixed Denial-of-service vulnerability in django.utils.text.Truncator (boo#1215978).

Record: openSUSE-SU-2023:0389-1
Updated: 2026-11-02

OSVopenSUSE-SU-2023:0390-1No score

Security update for python-Django1

This update for python-Django1 fixes the following issues:

CVE-2023-43665: Fixed Denial-of-service vulnerability in django.utils.text.Truncator (boo#1215978).

Record: openSUSE-SU-2023:0390-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13334-1No score

python310-Django-4.2.6-1.1 on GA media

These are all security issues fixed in the python310-Django-4.2.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13334-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14208-1No score

python310-Django4-4.2.14-1.1 on GA media

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14208-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10005-1No score

python312-Django6-6.0-1.1 on GA media

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10005-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11235-1No score

python313-Django4-4.2.30-4.1 on GA media

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11235-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11248-1No score

python313-Django-5.2.16-1.1 on GA media

These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11248-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11270-1No score

python313-Django5-5.2.16-1.1 on GA media

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11270-1
Updated: 2026-11-02

OSVPYSEC-2023-226No score

Record: PYSEC-2023-226
Updated: 2026-11-02

OSVSUSE-SU-2023:4232-1No score

Security update for python-Django

This update for python-Django fixes the following issues:

CVE-2023-43665: Fixed a Denial-of-service in django.utils.text.Truncator. (bsc#1215978)

Record: SUSE-SU-2023:4232-1
Updated: 2026-11-02

OSVSUSE-SU-2023:4426-1No score

Security update for python-Django1

This update for python-Django1 fixes the following issues:

CVE-2023-43665: Fixed a denial of service in django.utils.text.Truncator (bsc#1215978).

Record: SUSE-SU-2023:4426-1
Updated: 2026-11-02

OSVUSN-6414-1No score

python-django vulnerability

Wenchao Li discovered that the Django Truncator function incorrectly handled very long HTML input. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.

Record: USN-6414-1
Updated: 2026-11-02

OSVUSN-6414-2No score

python-django vulnerabilities

USN-6414-1 and USN-6378-1 fixed CVE-2023-43665 and CVE-2023-41164 in Django, respectively. This update provides the corresponding update for Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that Django incorrectly handled certain URIs with a very large number of Unicode characters. A remote attacker could possibly use this issue to cause Django to consume resources or crash, leading to a denial of service.

Record: USN-6414-2
Updated: 2026-11-02