[SECURITY] [DLA 1872-1] python-django security update

🗓️ 06 Aug 2019 10:07:39Reported by DebianType

Security update for python-django package with two CVE IDs - CVE-2019-14232 and CVE-2019-14233, fixing denial-of-service vulnerabilities in django.utils.text.Truncator and django.utils.html.strip_tags

Reporter	Title	Published	Views	Family All 124
ALT Linux	Security fix for the ALT Linux 9 package python3-module-django version 2.2.4-alt1	5 Aug 201900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package python3-module-django version 2.2.4-alt1	5 Aug 201900:00	–	altlinux
FreeBSD	Django -- multiple vulnerabilities	1 Aug 201900:00	–	freebsd
AlpineLinux	CVE-2019-14232	2 Aug 201900:00	–	alpinelinux
AlpineLinux	CVE-2019-14233	2 Aug 201914:31	–	alpinelinux
ArchLinux	[ASA-201908-2] python-django: multiple issues	5 Aug 201900:00	–	archlinux
ArchLinux	[ASA-201908-3] python2-django: multiple issues	5 Aug 201900:00	–	archlinux
BDU FSTEC	The vulnerability of the `django.utils.text.Truncator` class’s `chars()` and `words()` methods in the Django web development framework allows a attacker to cause a denial-of-service attack.	23 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the HTMLParser module from django.utils.html.strip_tags in the Django web development framework allows a attacker to cause a denial-of-service attack.	23 Apr 202000:00	–	bdu_fstec
Circl	CVE-2019-14232	16 Mar 202421:03	–	circl

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	8	any	python-django	1.7.11-1+deb8u7	python-django_1.7.11-1+deb8u7_any.deb
Debian	8	any	python-django-common	1.7.11-1+deb8u7	python-django-common_1.7.11-1+deb8u7_any.deb
Debian	8	any	python-django-doc	1.7.11-1+deb8u7	python-django-doc_1.7.11-1+deb8u7_any.deb
Debian	8	any	python3-django	1.7.11-1+deb8u7	python3-django_1.7.11-1+deb8u7_any.deb

06 Aug 2019 10:07Current

7.7High risk

Vulners AI Score7.7

CVSS 25

CVSS 37.5

CVSS 3.17.5

EPSS0.03502

SSVC