{"id":"CVE-2023-43665","published":"2023-11-03T00:00:00Z","modified":"2025-11-04T17:12:41Z","title":"In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01462,"percentile":0.73582,"provenance":"source"},"cwes":[],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":[]},{"url":"https://docs.djangoproject.com/en/4.2/releases/security/","tags":[]},{"url":"https://www.djangoproject.com/weblog/2023/oct/04/security-releases/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231221-0001/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/04/1","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/","tags":[]}],"priority":{"score":14.7,"factors":[{"name":"EPSS percentile","points":14.72}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=3.2a1, <3.2.22",">=4.1a1, <4.1.12",">=4.2a1, <4.2.6",">=3.2, <3.2.22",">=4.1, <4.1.12",">=4.2, <4.2.6"],"patched":["3.2.22","4.1.12","4.2.6"],"from":["GHSA-h8gc-pgj2-vjm3","PYSEC-2023-226"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0070","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2018-7537","parents":[{"from":"CVE-2019-14232","to":"CVE-2023-43665","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.","from":"CVE.org","in":"CVE-2023-43665"},{"kind":"similar","provenance":"machine","score":0.79,"basis":"same package + description similarity"}]},{"from":"CVE-2021-31542","to":"CVE-2023-43665","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/text.py"],"commits":["https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d","https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48","https://github.com/django/django/commit/be9c27c4d18c2e6a5be8af4e53c0797440794473","https://github.com/django/django/commit/c7b7024742250414e426ad49fb80db943e7ba4e8"],"basis":"shared function","functions":["_truncate_html"]}]}],"children":[{"from":"CVE-2023-43665","to":"CVE-2024-27351","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.","from":"CVE.org","in":"CVE-2024-27351"},{"kind":"same-code","provenance":"machine","files":["django/utils/text.py"],"commits":["https://github.com/django/django/commit/be9c27c4d18c2e6a5be8af4e53c0797440794473","https://github.com/django/django/commit/c7b7024742250414e426ad49fb80db943e7ba4e8","https://github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e","https://github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.62,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-31047","published":"2023-05-07","fixed":"4.2.1","kev":false},{"cve":"CVE-2023-36053","published":"2023-07-03","fixed":"4.2.3","kev":false},{"cve":"CVE-2023-41164","published":"2023-11-03","fixed":"4.2.5","kev":false,"link":{"from":"CVE-2023-41164","to":"CVE-2023-43665","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.21","toFixed":"3.2.22","daysApart":0},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.1.11","toFixed":"4.1.12","daysApart":0},{"kind":"similar","provenance":"machine","score":0.24,"basis":"same package + description similarity"}]}},{"cve":"CVE-2023-43665","published":"2023-11-03","fixed":"4.2.6","kev":false},{"cve":"CVE-2023-46695","published":"2023-11-02","fixed":"4.2.7","kev":false,"link":{"from":"CVE-2023-43665","to":"CVE-2023-46695","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.22","toFixed":"3.2.23","daysApart":-1},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.1.12","toFixed":"4.1.13","daysApart":-1}]}},{"cve":"CVE-2024-24680","published":"2024-02-06","fixed":"5.0.2","kev":false},{"cve":"CVE-2024-27351","published":"2024-03-15","fixed":"5.0.3","kev":false}],"package":"PyPI:Django"}}