CVE-2019-14233 log

Source
Severity Medium
Remote Yes
Type Denial of service
Description
Due to the behavior of the underlying HTMLParser, django.utils.html.strip_tags() would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. The strip_tags() method is used to implement the corresponding striptags template filter, which was thus also vulnerable. strip_tags() now avoids recursive calls to HTMLParser when progress removing tags, but necessarily incomplete HTML entities, stops being made
Group Package Affected Fixed Severity Status Ticket
AVG-1015 python-django 2.2.3-1 2.2.4-1 Medium Fixed
AVG-1014 python2-django 1.11.22-1 1.11.23-1 Medium Fixed
Date Advisory Group Package Severity Type
05 Aug 2019 ASA-201908-3 AVG-1014 python2-django Medium multiple issues
05 Aug 2019 ASA-201908-2 AVG-1015 python-django Medium multiple issues
References
https://docs.djangoproject.com/en/dev/releases/1.11.23/
https://github.com/django/django/commit/4b78420d250df5e21763633871e486ee76728cc4