Regular Expression Denial Of Service (ReDoS)

🗓️ 22 Mar 2024 04:01:57Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 23 Views

Django ReDoS vulnerability in Truncator.words() functio

Reporter	Title	Published	Views	Family All 163
FreeBSD	Django -- multiple vulnerabilities	25 Feb 202400:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Django-3.2.24-py3-none-any.whl is vulnerable to CVE-2024-27351 used in IBM Maximo Application Suite - Edge Data Collector	10 Apr 202410:49	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service and security restrictions bypass might affect IBM Storage Defender – Resiliency Service	3 Jul 202420:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.1 addresses multiple existing security vulnerabilities	2 Apr 202410:47	–	ibm
AlpineLinux	CVE-2024-27351	15 Mar 202400:00	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в python-django	3 May 202623:59	–	astralinux
Chainguard	CVE-2024-27351 vulnerabilities	15 Mar 202420:15	–	cgr
Circl	CVE-2024-27351	4 Mar 202410:41	–	circl
CNNVD	Django Security Vulnerabilities	4 Mar 202400:00	–	cnnvd
CVE	CVE-2024-27351	15 Mar 202400:00	–	cve

Vulners

Node

py3-django py3-djangoMatch3.1.7-r1python

AND

py3-django py3-djangoMatch3.2.18-r1python

AND

py3-django py3-djangoMatch1.11.29-r0python

AND

py3-django py3-djangoMatch3.2.18-r0python

AND

py3-django py3-djangoMatch3.1.7-r0python

AND

py3-django py3-djangoMatch4.2.6-r0python

AND

py3-django py3-djangoMatch4.2.3-r0python

AND

py3-django py3-djangoMatch4.2.7-r0python

AND

py3-django py3-djangoMatch3.2.15-r0python

AND

py3-django py3-djangoMatch3.2.16-r1python

AND

py3-django py3-djangoMatch4.2.5-r0python

AND

py3-django py3-djangoMatch4.2.10-r0python

AND

py3-django py3-djangoMatch4.2-r1python

AND

py3-django py3-djangoMatch3.2.16-r0python

AND

py3-django py3-djangoMatch3.2.12-r0python

AND

py3-django py3-djangoMatch4.2-r0python

AND

py3-django py3-djangoMatch4.2.1-r0python

AND

py3-django py3-djangoMatch3.1.13-r1python

AND

py3-django py3-djangoMatch3.2.14-r0python

AND

py3-django py3-djangoMatch1.11.28-r0python

AND

py3-django py3-djangoMatch3.2.17-r0python

AND

py3-django py3-djangoMatch4.2.2-r0python

AND

py3-django py3-djangoMatch3.1.8-r0python

AND

py3-django py3-djangoMatch3.1.13-r0python

AND

py3-django py3-djangoMatch3.2.13-r0python

AND

alpinelinux alpine_linuxMatchedge

django_project djangoRange3.0a1–3.2.24python

django_project djangoRange4.0a1–4.2.10python

django_project djangoRange5.0a1–5.0.2python

Source	Link
docs	www.docs.djangoproject.com/en/dev/releases/5.0.3/
github	www.github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e
github	www.github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521
github	www.github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a
djangoproject	www.djangoproject.com/weblog/2024/mar/04/security-releases/
docs	www.docs.djangoproject.com/en/5.0/releases/security/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/
groups	www.groups.google.com/forum/

01 May 2024 19:52Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.15.3

EPSS0.02611

SSVC