id: PYSEC-2023-226
modified: 2023-11-03T10:29:40.328470Z
published: 2023-11-03T05:15:00Z
aliases:
- CVE-2023-43665
- GHSA-h8gc-pgj2-vjm3
details: 'In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the
  django.utils.text.Truncator chars() and words() methods (when used with html=True)
  are subject to a potential DoS (denial of service) attack via certain inputs with
  very long, potentially malformed HTML text. The chars() and words() methods are
  used to implement the truncatechars_html and truncatewords_html template filters,
  which are thus also vulnerable. NOTE: this issue exists because of an incomplete
  fix for CVE-2019-14232.'
affected:
- package:
    ecosystem: PyPI
    name: django
    purl: pkg:pypi/django
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "3.2"
    - fixed: 3.2.22
    - introduced: "4.1"
    - fixed: 4.1.12
    - introduced: "4.2"
    - fixed: 4.2.6
  versions:
  - "3.2"
  - 3.2.1
  - 3.2.10
  - 3.2.11
  - 3.2.12
  - 3.2.13
  - 3.2.14
  - 3.2.15
  - 3.2.16
  - 3.2.17
  - 3.2.18
  - 3.2.19
  - 3.2.2
  - 3.2.20
  - 3.2.21
  - 3.2.3
  - 3.2.4
  - 3.2.5
  - 3.2.6
  - 3.2.7
  - 3.2.8
  - 3.2.9
  - "4.1"
  - 4.1.1
  - 4.1.10
  - 4.1.11
  - 4.1.2
  - 4.1.3
  - 4.1.4
  - 4.1.5
  - 4.1.6
  - 4.1.7
  - 4.1.8
  - 4.1.9
  - "4.2"
  - 4.2.1
  - 4.2.2
  - 4.2.3
  - 4.2.4
  - 4.2.5
references:
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2023/oct/04/security-releases/
- type: WEB
  url: https://docs.djangoproject.com/en/4.2/releases/security/
- type: WEB
  url: https://groups.google.com/forum/#!forum/django-announce
- type: ADVISORY
  url: https://github.com/advisories/GHSA-h8gc-pgj2-vjm3