Oct 13,2023
CVE-2023-41164: Potential denial of service vulnerability in django.utils.encoding.uri_to_iri()
===================================================================================================
django.utils.encoding.uri_to_iri()
was subject to potential denial of
service attack via certain inputs with a very large number of Unicode
characters.
django.utils.text.Truncator
¶Following the fix for CVE-2019-14232, the regular expressions used in the
implementation of django.utils.text.Truncator
’s chars()
and words()
methods (with html=True
) were revised and improved. However, these regular
expressions still exhibited linear backtracking complexity, so when given a
very long, potentially malformed HTML input, the evaluation would still be
slow, leading to a potential denial of service vulnerability.
The chars()
and words()
methods are used to implement the
truncatechars_html
and truncatewords_html
template
filters, which were thus also vulnerable.
The input processed by Truncator
, when operating in HTML mode, has been
limited to the first five million characters in order to avoid potential
performance and memory issues.
September 1, 2020
Django 2.2.16 fixes two security issues and two data loss bugs in 2.2.15.
QuerySet.explain(**options)
on PostgreSQL¶QuerySet.explain()
method was subject to SQL injection in option names,
using a suitably crafted dictionary, with dictionary expansion, as the
**options
argument.
QuerySet.annotate()
, aggregate()
, and extra()
¶QuerySet.annotate()
, aggregate()
, and
extra()
methods were subject to SQL injection in column
aliases, using a suitably crafted dictionary, with dictionary expansion, as the
**kwargs
passed to these methods.
On Python 3.7+, FILE_UPLOAD_DIRECTORY_PERMISSIONS
mode was not
applied to intermediate-level directories created in the process of uploading
files and to intermediate-level collected static directories when using the
collectstatic
management command.
You should review and manually fix permissions on existing intermediate-level directories.
On Python 3.7+, the intermediate-level directories of the file system cache had
the system’s standard umask rather than 0o077
(no group or others
permissions).
select_for_update()
. When using
related fields pointing to a proxy model in the of
argument, the
corresponding model was not locked (#31866).Oct 13, 2023