[Snyk: Med] Django (Due 12/11/23)

[tmpayton]

django
Regular Expression Denial of Service (ReDoS)
VULNERABILITY

SCORE
551

Introduced through
django@3.2.21, django-jinja@2.10.2 and others
Fixed in
django@3.2.22, @4.1.12, @4.2.6

Exploit maturity
NO KNOWN EXPLOIT

Detailed paths and remediation
Introduced through: project@0.0.0 › django@3.2.21
Fix: Upgrade django to version 3.2.22 or 4.1.12 or 4.2.6
Introduced through: project@0.0.0 › django-jinja@2.10.2 › django@3.2.21
Fix: Pin django to version 3.2.22 or 4.1.12 or 4.2.6
Introduced through: project@0.0.0 › django-storages@1.7.1 › django@3.2.21
Fix: Pin django to version 3.2.22 or 4.1.12 or 4.2.6
…and 8 more

Security information
Factors contributing to the scoring:
Snyk: CVSS 5.3 - Medium Severity

NVD: Not available. NVD has not yet published its analysis.
Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the chars() and words() methods in the django.utils.text.Truncator function. An attacker can cause a denial of service by exploiting the inefficient regular expression complexity, which exhibits linear backtracking complexity and can be slow, given certain long and potentially malformed HTML inputs.

Introduced through
django@3.2.21, django-jinja@2.10.2 and others

Exploit maturity
No known exploit

Detailed paths

Introduced through: project@0.0.0 › django@3.2.21
Fix: No remediation path available.
Introduced through: project@0.0.0 › django-jinja@2.10.2 › django@3.2.21
Fix: No remediation path available.
Introduced through: project@0.0.0 › django-storages@1.7.1 › django@3.2.21
Fix: No remediation path available. 

…and 8 more
Security information
Factors contributing to the scoring:

Snyk: [CVSS 5.3](https://security.snyk.io/vuln/SNYK-PYTHON-DJANGO-6041515) - Medium Severity
NVD: Not available. NVD has not yet published its analysis.

Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) via the NFKC normalization function in django.contrib.auth.forms.UsernameField. A potential attack can be executed via certain inputs with a very large number of Unicode characters.

[cnlucas]

cloud-gov/cg-django-uaa#70