An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If
    passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a
    recursion when repercent-encoding invalid UTF-8 octet sequences. (CVE-2019-14235)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If     passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a     recursion when repercent-encoding invalid UTF-8 octet sequences. (CVE-2019-14235)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If
    django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were
    extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular
    expression. The chars() and words() methods are used to implement the truncatechars_html and
    truncatewords_html template filters, which were thus vulnerable. (CVE-2019-14232)

  - An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due
    to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to
    evaluate certain inputs containing large sequences of nested incomplete HTML entities. (CVE-2019-14233)

  - An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due
    to an error in shallow key transformation, key and index lookups for
    django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField,
    were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key
    or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as
    the **kwargs passed to the QuerySet.filter() function. (CVE-2019-14234)

  - An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If
    passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a
    recursion when repercent-encoding invalid UTF-8 octet sequences. (CVE-2019-14235)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1324 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    Security Fix(es):

    * Incorrect HTTP detection with reverse-proxy connecting via HTTPS     (CVE-2019-12781)

    * backtracking in a regular expression in django.utils.text.Truncator leads     to DoS (CVE-2019-14232)

    * the behavior of the underlying HTMLParser leading to DoS (CVE-2019-14233)

    * SQL injection possibility in key and index lookups for     JSONField/HStoreField (CVE-2019-14234)

    * Potential memory exhaustion in django.utils.encoding.uri_to_iri()     (CVE-2019-14235)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4390 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    Security Fix(es):

    * Incorrect HTTP detection with reverse-proxy connecting via HTTPS     (CVE-2019-12781)

    * backtracking in a regular expression in django.utils.text.Truncator leads     to DoS (CVE-2019-14232)

    * the behavior of the underlying HTMLParser leading to DoS (CVE-2019-14233)

    * SQL injection possibility in key and index lookups for     JSONField/HStoreField (CVE-2019-14234)

    * Potential memory exhaustion in django.utils.encoding.uri_to_iri()     (CVE-2019-14235)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202004-17 (Django: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Django. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by sending specially crafted input, could possibly       cause a Denial of Service condition, or alter the database.
  Workaround :

    There is no known workaround at this time.

fixes for CVE-2019-14232 to 14235

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in python-django, a web development framework. They could lead to remote denial-of-service or SQL injection,

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4084-1 advisory.

    It was discovered that Django incorrectly handled the Truncator function. A remote attacker could possibly     use this issue to cause Django to consume resources, leading to a denial of service. (CVE-2019-14232)

    It was discovered that Django incorrectly handled the strip_tags function. A remote attacker could     possibly use this issue to cause Django to consume resources, leading to a denial of service.
    (CVE-2019-14233)

    It was discovered that Django incorrectly handled certain lookups in the PostgreSQL support. A remote     attacker could possibly use this issue to perform SQL injection attacks. (CVE-2019-14234)

    It was discovered that Django incorrectly handled certain invalid UTF-8 octet sequences. A remote attacker     could possibly use this issue to cause Django to consume resources, leading to a denial of service.
    (CVE-2019-14235)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python-Django fixes the following issues :

Security issues fixed :

&#9; - CVE-2019-11358: Fixed prototype pollution.

  - CVE-2019-12308: Fixed XSS in AdminURLFieldWidget     (bsc#1136468)

  - CVE-2019-12781: Fixed incorrect HTTP detection with     reverse-proxy connecting via HTTPS (bsc#1139945).

  - CVE-2019-14232: Fixed denial-of-service possibility in     ``django.utils.text.Truncator`` (bsc#1142880).

  - CVE-2019-14233: Fixed denial-of-service possibility in     ``strip_tags()`` (bsc#1142882).

  - CVE-2019-14234: Fixed SQL injection possibility in key     and index lookups for ``JSONField``/``HStoreField``     (bsc#1142883).

  - CVE-2019-14235: Fixed potential memory exhaustion in     ``django.utils.encoding.uri_to_iri()`` (bsc#1142885).

Non-security issues fixed :

  - Fixed a migration crash on PostgreSQL when adding a     check constraint with a contains lookup on     DateRangeField or DateTimeRangeField, if the right hand     side of an expression is the same type.

Django release notes :

CVE-2019-14232: Denial-of-service possibility in django.utils.text.Truncator

If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable

The regular expressions used by Truncator have been simplified in order to avoid potential backtracking issues. As a consequence, trailing punctuation may now at times be included in the truncated output.

CVE-2019-14233: Denial-of-service possibility in strip_tags()

Due to the behavior of the underlying HTMLParser, django.utils.html.strip_tags() would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. The strip_tags() method is used to implement the corresponding striptags template filter, which was thus also vulnerable.

strip_tags() now avoids recursive calls to HTMLParser when progress removing tags, but necessarily incomplete HTML entities, stops being made.

Remember that absolutely NO guarantee is provided about the results of strip_tags() being HTML safe. So NEVER mark safe the result of a strip_tags() call without escaping it first, for example with django.utils.html.escape().

CVE-2019-14234: SQL injection possibility in key and index lookups for JSONField/HStoreField

Key and index lookups for JSONField and key lookups for HStoreField were subject to SQL injection, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.filter().

CVE-2019-14235: Potential memory exhaustion in django.utils.encoding.uri_to_iri()

If passed certain inputs, django.utils.encoding.uri_to_iri() could lead to significant memory usage due to excessive recursion when re-percent-encoding invalid UTF-8 octet sequences.

uri_to_iri() now avoids recursion when re-percent-encoding invalid UTF-8 octet sequences.

ID	Name	Product	Family	Severity
422957	SCA: security update for Django (GHSA-v9qg-3j8p-r63v)	Tenable Cloud Security	SCA Checks	high
422957	SCA: security update for Django (GHSA-v9qg-3j8p-r63v)	Tenable Self-Hosted Container Security	SCA Checks	high
222472	Linux Distros Unpatched Vulnerability : CVE-2019-14235	Nessus	Misc.	high
406646	Alpine: multiple py3-django packages: security update to 1.11.23-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406646	Alpine: multiple py3-django packages: security update to 1.11.23-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
406607	Alpine: py-django: security update to 1.11.23-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406607	Alpine: py-django: security update to 1.11.23-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
170305	RHEL 8 : python-django (RHSA-2020:1324)	Nessus	Red Hat Local Security Checks	critical
142030	RHEL 7 : python-django (RHSA-2020:4390)	Nessus	Red Hat Local Security Checks	critical
136216	GLSA-202004-17 : Django: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
127936	Fedora 30 : python-django (2019-647f74ce51)	Nessus	Fedora Local Security Checks	critical
127822	Debian DSA-4498-1 : python-django - security update	Nessus	Debian Local Security Checks	critical
127801	Ubuntu 16.04 LTS / 18.04 LTS : Django vulnerabilities (USN-4084-1)	Nessus	Ubuntu Local Security Checks	critical
127742	openSUSE Security Update : python-Django (openSUSE-2019-1839)	Nessus	SuSE Local Security Checks	critical
127547	FreeBSD : Django -- multiple vulnerabilities (6e65dfea-b614-11e9-a3a2-1506e15611cc)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-14235

high

Tenable Plugins

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical