Alpine: py-django: security update to 1.11.23-r0

critical Tenable Self-Hosted Container Security Plugin ID 406607

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If
django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were
extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular
expression. The chars() and words() methods are used to implement the truncatechars_html and
truncatewords_html template filters, which were thus vulnerable. (CVE-2019-14232)

- An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due
to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to
evaluate certain inputs containing large sequences of nested incomplete HTML entities. (CVE-2019-14233)

- An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due
to an error in shallow key transformation, key and index lookups for
django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField,
were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key
or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as
the **kwargs passed to the QuerySet.filter() function. (CVE-2019-14234)

- An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If
passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a
recursion when repercent-encoding invalid UTF-8 octet sequences. (CVE-2019-14235)

Plugin Details

Severity: Critical

ID: 406607

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-14234

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/2/2019

Reference Information

CVE: CVE-2019-14232, CVE-2019-14233, CVE-2019-14234, CVE-2019-14235

Detections

Analytics