CVE-2019-14233 log
| Source |
|
| Severity | Medium |
| Remote | Yes |
| Type | Denial of service |
| Description | Due to the behavior of the underlying HTMLParser, django.utils.html.strip_tags() would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. The strip_tags() method is used to implement the corresponding striptags template filter, which was thus also vulnerable. strip_tags() now avoids recursive calls to HTMLParser when progress removing tags, but necessarily incomplete HTML entities, stops being made |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-1015 | python-django | 2.2.3-1 | 2.2.4-1 | Medium | Fixed | |
| AVG-1014 | python2-django | 1.11.22-1 | 1.11.23-1 | Medium | Fixed |
| Date | Advisory | Group | Package | Severity | Type |
|---|---|---|---|---|---|
| 05 Aug 2019 | ASA-201908-3 | AVG-1014 | python2-django | Medium | multiple issues |
| 05 Aug 2019 | ASA-201908-2 | AVG-1015 | python-django | Medium | multiple issues |
| References |
|---|
https://docs.djangoproject.com/en/dev/releases/1.11.23/ https://github.com/django/django/commit/4b78420d250df5e21763633871e486ee76728cc4 |