[ASA-201908-2] python-django: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201908-2
=========================================

Severity: Medium
Date    : 2019-08-05
CVE-ID  : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235
Package : python-django
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1015

Summary
=======

The package python-django before version 2.2.4-1 is vulnerable to
multiple issues including denial of service and sql injection.

Resolution
==========

Upgrade to 2.2.4-1.

# pacman -Syu "python-django>=2.2.4-1"

The problems have been fixed upstream in version 2.2.4.

Workaround
==========

None.

Description
===========

- CVE-2019-14232 (denial of service)

If ``django.utils.text.Truncator``'s ``chars()`` and ``words()``
methods were passed the ``html=True`` argument, they were extremely
slow to evaluate certain inputs due to a catastrophic backtracking
vulnerability in a regular expression. The ``chars()`` and ``words()``
methods are used to implement the ``truncatechars_html`` and
``truncatewords_html`` template filters, which were thus vulnerable.
The regular expressions used by ``Truncator`` have been simplified in
order to avoid potential backtracking issues. As a consequence,
trailing punctuation may now at times be included in the truncated
output.

- CVE-2019-14233 (denial of service)

Due to the behavior of the underlying HTMLParser,
django.utils.html.strip_tags() would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML
entities. The strip_tags() method is used to implement the
corresponding striptags template filter, which was thus also
vulnerable. strip_tags() now avoids recursive calls to HTMLParser when
progress removing tags, but necessarily incomplete HTML entities, stops
being made

- CVE-2019-14234 (sql injection)

Key and index lookups for JSONField and key lookups for HStoreField
were subject to SQL injection, using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to QuerySet.filter().

- CVE-2019-14235 (denial of service)

If passed certain inputs, django.utils.encoding.uri_to_iri() could lead
to significant memory usage due to excessive recursion when re-percent
encoding invalid UTF-8 octet sequences.

Impact
======

A remote attacker can cause a denial of service via crafted content, or
alter the database via a SQL injection.

References
==========

https://docs.djangoproject.com/en/dev/releases/1.11.23/
https://github.com/django/django/commit/7f65974f8219729c047fbbf8cd5cc9d80faefe77
https://github.com/django/django/commit/4b78420d250df5e21763633871e486ee76728cc4
https://github.com/django/django/commit/7deeabc7c7526786df6894429ce89a9c4b614086
https://github.com/django/django/commit/76ed1c49f804d409cfc2911a890c78584db3c76e
https://security.archlinux.org/CVE-2019-14232
https://security.archlinux.org/CVE-2019-14233
https://security.archlinux.org/CVE-2019-14234
https://security.archlinux.org/CVE-2019-14235

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20190807/8e524e40/attachment.sig>