{"id":"CVE-2019-14232","published":"2019-08-02T00:00:00Z","modified":"2024-08-05T00:12:42Z","title":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.03531,"percentile":0.89242,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":[]},{"url":"https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs","tags":[]},{"url":"https://www.djangoproject.com/weblog/2019/aug/01/security-releases/","tags":[]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html","tags":["vendor-advisory"]},{"url":"https://seclists.org/bugtraq/2019/Aug/15","tags":["mailing-list"]},{"url":"https://www.debian.org/security/2019/dsa-4498","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190828-0002/","tags":[]},{"url":"https://security.gentoo.org/glsa/202004-17","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/04/6","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/04/1","tags":["mailing-list"]}],"priority":{"score":23.1,"factors":[{"name":"EPSS percentile","points":17.85},{"name":"CVSS severity","points":5.25}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.11a1, <1.11.23",">=2.1a1, <2.1.11",">=2.2a1, <2.2.4",">=1.11, <1.11.23",">=2.1, <2.1.11",">=2.2, <2.2.4"],"patched":["1.11.23","2.1.11","2.2.4"],"from":["GHSA-c4qh-4vgv-qc6g","PYSEC-2019-11"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0035","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2018-7537","children":[{"from":"CVE-2019-14232","to":"CVE-2023-43665","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.","from":"CVE.org","in":"CVE-2023-43665"},{"kind":"similar","provenance":"machine","score":0.79,"basis":"same package + description similarity"}]},{"from":"CVE-2019-14232","to":"CVE-2024-27351","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.","from":"CVE.org","in":"CVE-2024-27351"}]}]}}