Affected: Bitnami: django

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Affected: PyPI: Django

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Affected: openEuler:20.03-LTS-SP1: python-django, openEuler:20.03-LTS-SP4: python-django, openEuler:22.03-LTS: python-django, openEuler:22.03-LTS-SP1: python-django, openEuler:22.03-LTS-SP2: python-django, openEuler:22.03-LTS-SP3: python-django

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es): An inefficient regular expression complexity flaw was found in the Truncator.words function and truncatewords_html filter of Django. This issue may allow an attacker to use a suitably crafted string to cause a denial of service.(CVE-2024-27351)

Security update for python-Django1

Affected: PyPI: django

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests GitPython: Blind local file inclusion axios: exposure of confidential data stored in cookies python-twisted: disordered HTTP pipeline response in twisted.web python-aiohttp: numerous issues in HTTP parser with header parsing python-cryptography: NULL-dereference when loading PKCS7 certificates golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads jinja2: HTML attribute injection when passing user input as keys to xmlattr filter aiohttp: follow_symlinks directory traversal vulnerability python-aiohttp: http request smuggling Django: denial-of-service in ``intcomma`` template filter python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

Security update for python-Django1

Affected: Ubuntu:Pro:14.04:LTS: python-django, Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Django ausnutzen, um einen Denial of Service Angriff durchzuführen.