CVE-2019-14232 log

Source
Severity Medium
Remote Yes
Type Denial of service
Description
If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were passed the ``html=True`` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The ``chars()`` and ``words()`` methods are used to implement the ``truncatechars_html`` and ``truncatewords_html`` template filters, which were thus vulnerable. The regular expressions used by ``Truncator`` have been simplified in order to avoid potential backtracking issues. As a consequence, trailing punctuation may now at times be included in the truncated output.
Group Package Affected Fixed Severity Status Ticket
AVG-1015 python-django 2.2.3-1 2.2.4-1 Medium Fixed
AVG-1014 python2-django 1.11.22-1 1.11.23-1 Medium Fixed
Date Advisory Group Package Severity Description
05 Aug 2019 ASA-201908-3 AVG-1014 python2-django Medium multiple issues
05 Aug 2019 ASA-201908-2 AVG-1015 python-django Medium multiple issues
References
https://docs.djangoproject.com/en/dev/releases/1.11.23/
https://github.com/django/django/commit/7f65974f8219729c047fbbf8cd5cc9d80faefe77