Regular Expression Denial Of Service (ReDoS)

🗓️ 30 Oct 2023 06:23:22Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 46 Views

Django vulnerable to ReDoS in `text.py` function

Reporter	Title	Published	Views	Family All 160
FreeBSD	Django -- multiple vulnerabilities	1 Oct 202300:00	–	freebsd
AlpineLinux	CVE-2023-43665	3 Nov 202300:00	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in Python-Django	3 May 202623:59	–	astralinux
BDU FSTEC	The vulnerability of the Django web application framework, related to the inefficient complexity of regular expressions, allows attackers to trigger a service failure.	31 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-43665	22 Dec 202300:26	–	circl
CNNVD	Django Security Vulnerabilities	4 Oct 202300:00	–	cnnvd
CVE	CVE-2023-43665	3 Nov 202300:00	–	cve
Cvelist	CVE-2023-43665	3 Nov 202300:00	–	cvelist
Debian	[SECURITY] [DLA 4210-1] python-django security update	9 Jun 202515:47	–	debian
Debian	[SECURITY] [DSA 6136-1] python-django security update	15 Feb 202621:52	–	debian

Vulners

Node

py3-django py3-djangoMatch4.2.5-r0python

AND

py3-django py3-djangoMatch4.2-r1python

AND

py3-django py3-djangoMatch4.2.2-r0python

AND

py3-django py3-djangoMatch4.2.3-r0python

AND

py3-django py3-djangoMatch4.2.1-r0python

AND

alpinelinux alpine_linuxMatch3.18

OR

py3-django py3-djangoMatch3.2.18-r1python

AND

py3-django py3-djangoMatch4.2.2-r0python

AND

py3-django py3-djangoMatch3.1.7-r0python

AND

py3-django py3-djangoMatch3.1.13-r1python

AND

py3-django py3-djangoMatch3.2.16-r0python

AND

py3-django py3-djangoMatch4.2.3-r0python

AND

py3-django py3-djangoMatch4.2-r0python

AND

py3-django py3-djangoMatch3.2.13-r0python

AND

py3-django py3-djangoMatch1.11.28-r0python

AND

py3-django py3-djangoMatch3.2.15-r0python

AND

py3-django py3-djangoMatch3.2.18-r0python

AND

py3-django py3-djangoMatch3.2.17-r0python

AND

py3-django py3-djangoMatch4.2-r1python

AND

py3-django py3-djangoMatch3.2.12-r0python

AND

py3-django py3-djangoMatch3.2.14-r0python

AND

py3-django py3-djangoMatch1.11.29-r0python

AND

py3-django py3-djangoMatch3.1.13-r0python

AND

py3-django py3-djangoMatch3.1.7-r1python

AND

py3-django py3-djangoMatch3.2.16-r1python

AND

py3-django py3-djangoMatch3.1.8-r0python

AND

py3-django py3-djangoMatch4.2.5-r0python

AND

py3-django py3-djangoMatch4.2.1-r0python

AND

alpinelinux alpine_linuxMatchedge

OR

django_project djangoRange1.11.23–3.2.21python

OR

django_project djangoRange4.0a1–4.1.11python

OR

django_project djangoRange4.2–4.2.5python

OR

django_project djangoMatch5.0a1python

Source	Link
djangoproject	www.djangoproject.com/weblog/2023/oct/04/security-releases/
github	www.github.com/django/django/commit/17b51094d778b421bb2b3aae0c270894b050455d
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/
docs	www.docs.djangoproject.com/en/4.2/releases/security/
groups	www.groups.google.com/forum/
groups	www.groups.google.com/forum/
security	www.security.netapp.com/advisory/ntap-20231221-0001/

01 May 2024 19:52Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.01236

django redos vulnerability text.py functions slow evaluation dos