Arch Linux Security Advisory ASA-201908-2 ========================================= Severity: Medium Date : 2019-08-05 CVE-ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1015 Summary ======= The package python-django before version 2.2.4-1 is vulnerable to multiple issues including denial of service and sql injection. Resolution ========== Upgrade to 2.2.4-1. # pacman -Syu "python-django>=2.2.4-1" The problems have been fixed upstream in version 2.2.4. Workaround ========== None. Description =========== - CVE-2019-14232 (denial of service) If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were passed the ``html=True`` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The ``chars()`` and ``words()`` methods are used to implement the ``truncatechars_html`` and ``truncatewords_html`` template filters, which were thus vulnerable. The regular expressions used by ``Truncator`` have been simplified in order to avoid potential backtracking issues. As a consequence, trailing punctuation may now at times be included in the truncated output. - CVE-2019-14233 (denial of service) Due to the behavior of the underlying HTMLParser, django.utils.html.strip_tags() would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. The strip_tags() method is used to implement the corresponding striptags template filter, which was thus also vulnerable. strip_tags() now avoids recursive calls to HTMLParser when progress removing tags, but necessarily incomplete HTML entities, stops being made - CVE-2019-14234 (sql injection) Key and index lookups for JSONField and key lookups for HStoreField were subject to SQL injection, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.filter(). - CVE-2019-14235 (denial of service) If passed certain inputs, django.utils.encoding.uri_to_iri() could lead to significant memory usage due to excessive recursion when re-percent encoding invalid UTF-8 octet sequences. Impact ====== A remote attacker can cause a denial of service via crafted content, or alter the database via a SQL injection. References ========== https://docs.djangoproject.com/en/dev/releases/1.11.23/ https://github.com/django/django/commit/7f65974f8219729c047fbbf8cd5cc9d80fae... https://github.com/django/django/commit/4b78420d250df5e21763633871e486ee7672... https://github.com/django/django/commit/7deeabc7c7526786df6894429ce89a9c4b61... https://github.com/django/django/commit/76ed1c49f804d409cfc2911a890c78584db3... https://security.archlinux.org/CVE-2019-14232 https://security.archlinux.org/CVE-2019-14233 https://security.archlinux.org/CVE-2019-14234 https://security.archlinux.org/CVE-2019-14235