Vulnerability advisory
CVE-2023-41164
Also known as BIT-django-2023-41164GHSA-7h4p-27mh-hmrwPYSEC-2023-225
Severity
Severity not reported.
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/django/django ↗ | |
| 3591e1c1acbd7c13174275367c3fdf012cb0413b to before fd0ccd7fb3ec8aee9a88ab0576059c7393397c8d | fd0ccd7fb3ec8aee9a88ab0576059c7393397c8d |
| 9fee86e44dd83dc968ec443adcde191b3eba1286 to before 618a0e797b54c62d9ee78c3c5bdc27f954685836 | 618a0e797b54c62d9ee78c3c5bdc27f954685836 |
| 97aa3b7f08f51669e118f3af5ca91026e39664c3 to before b8b2f7451201f3ff60891b6ce55f177400700d7a | b8b2f7451201f3ff60891b6ce55f177400700d7a |
Description
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
References
- Webdocs.djangoproject.com/en/4.2/releases/security/ ↗
- Webgroups.google.com/forum/#%21forum/django-announce ↗
- Weblists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/ ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41164.json ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/ ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-41164 ↗
- Advisorysecurity.netapp.com/advisory/ntap-20231214-0002/ ↗
- ARTICLEwww.djangoproject.com/weblog/2023/sep/04/security-releases/ ↗