[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 1 Aug 2019 11:28:22 +0200
From: Carlton Gibson <carlton.gibson@...il.com>
To: oss-security@...ts.openwall.com
Subject: Django security releases issued: Multiple CVEs
Permalink: https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
In accordance with `our security release policy <https://docs.djangoproject.com/en/dev/internals/security/>`_, the Django team is issuing `Django 1.11.23 <https://docs.djangoproject.com/en/dev/releases/1.11.23/>`_, `Django 2.1.11 <https://docs.djangoproject.com/en/dev/releases/2.1.11/>`_, and `Django 2.2.4 <https://docs.djangoproject.com/en/dev/releases/2.2.4/>`_. These releases addresses the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.
Thanks Guido Vranken and Sage M. Abdullah for reporting these issues.
CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``
================================================================================
If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods
were passed the ``html=True`` argument, they were extremely slow to evaluate
certain inputs due to a catastrophic backtracking vulnerability in a regular
expression. The ``chars()`` and ``words()`` methods are used to implement the
``truncatechars_html`` and ``truncatewords_html`` template
filters, which were thus vulnerable.
The regular expressions used by ``Truncator`` have been simplified in order to
avoid potential backtracking issues. As a consequence, trailing punctuation may
now at times be included in the truncated output.
CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
=================================================================
Due to the behavior of the underlying ``HTMLParser``,
``django.utils.html.strip_tags()`` would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The ``strip_tags()`` method is used to implement the corresponding
``striptags`` template filter, which was thus also vulnerable.
``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
removing tags, but necessarily incomplete HTML entities, stops being made.
Remember that absolutely NO guarantee is provided about the results of
``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
``strip_tags()`` call without escaping it first, for example with
``django.utils.html.escape()``.
CVE-2019-14234: SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField``
====================================================================================================
Key and index lookups for
``django.contrib.postgres.fields.JSONField`` and key lookups for ``django.contrib.postgres.fields.HStoreField``
were subject to SQL injection, using a suitably crafted dictionary, with
dictionary expansion, as the ``**kwargs`` passed to ``QuerySet.filter()``.
CVE-2019-14235: Potential memory exhaustion in ``django.utils.encoding.uri_to_iri()``
=====================================================================================
If passed certain inputs, ``django.utils.encoding.uri_to_iri`` could lead
to significant memory usage due to excessive recursion when re-percent-encoding
invalid UTF-8 octet sequences.
``uri_to_iri()`` now avoids recursion when re-percent-encoding invalid UTF-8
octet sequences.
Affected supported versions
===========================
* Django master development branch
* Django 2.2 before version 2.2.4
* Django 2.1 before version 2.1.11
* Django 1.11 before version 1.11.23
Resolution
==========
Patches to resolve the issue have been applied to Django's master branch and
the 2.2, 2.1, and 1.11 release branches. The patches may be obtained from the following changesets:
On the development master branch:
* `master Truncator <https://github.com/django/django/commit/7f65974f8219729c047fbbf8cd5cc9d80faefe77>`__
* `master strip_tags() <https://github.com/django/django/commit/4b78420d250df5e21763633871e486ee76728cc4>`__
* `master JSONField/HStoreField <https://github.com/django/django/commit/7deeabc7c7526786df6894429ce89a9c4b614086>`__
* `master uri_to_iri() <https://github.com/django/django/commit/76ed1c49f804d409cfc2911a890c78584db3c76e>`__
On the Django 2.2 release branch:
* `2.2 Truncator <https://github.com/django/django/commit/c3289717c6f21a8cf23daff1c78c0c014b94041f>`__
* `2.2 strip_tags() <https://github.com/django/django/commit/e34f3c0e9ee5fc9022428fe91640638bafd4cda7>`__
* `2.2 JSONField/HStoreField <https://github.com/django/django/commit/4f5b58f5cd3c57fee9972ab074f8dc6895d8f387>`__
* `2.2 uri_to_iri() <https://github.com/django/django/commit/cf694e6852b0da7799f8b53f1fb2f7d20cf17534>`__
On the Django 2.1 release branch:
* `2.1 Truncator <https://github.com/django/django/commit/c23723a1551340cc7d3126f04fcfd178fa224193>`__
* `2.1 strip_tags() <https://github.com/django/django/commit/5ff8e791148bd451180124d76a55cb2b2b9556eb>`__
* `2.1 JSONField/HStoreField <https://github.com/django/django/commit/f74b3ae3628c26e1b4f8db3d13a91d52a833a975>`__
* `2.1 uri_to_iri() <https://github.com/django/django/commit/5d50a2e5fa36ad23ab532fc54cf4073de84b3306>`__
On the Django 1.11 release branch:
* `1.11 Truncator <https://github.com/django/django/commit/42a66e969023c00536256469f0e8b8a099ef109d>`__
* `1.11 strip_tags() <https://github.com/django/django/commit/52479acce792ad80bb0f915f20b835f919993c72>`__
* `1.11 JSONField/HStoreField <https://github.com/django/django/commit/ed682a24fca774818542757651bfba576c3fc3ef>`__
* `1.11 uri_to_iri() <https://github.com/django/django/commit/869b34e9b3be3a4cfcb3a145f218ffd3f5e3fd79>`__
The following releases have been issued:
* Django 1.11.23 (`download Django 1.11.23 <https://www.djangoproject.com/m/releases/1.11/Django-1.11.23.tar.gz>`_ | `1.11.23 checksums <https://www.djangoproject.com/m/pgp/Django-1.11.23.checksum.txt>`_)
* Django 2.1.11 (`download Django 2.1.11 <https://www.djangoproject.com/m/releases/2.1/Django-2.1.11.tar.gz>`_ | `2.1.11 checksums <https://www.djangoproject.com/m/pgp/Django-2.1.11.checksum.txt>`_)
* Django 2.2.4 (`download Django 2.2.4 <https://www.djangoproject.com/m/releases/2.2/Django-2.2.4.tar.gz>`_ | `2.2.4 checksums <https://www.djangoproject.com/m/pgp/Django-2.2.4.checksum.txt>`_)
The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00
General notes regarding security reporting
==========================================
As always, we ask that potential security issues be reported via
private email to ``security@...ngoproject.com``, and not via Django's
Trac instance, Django's GitHub repositories, or the django-developers list.
Please see `our security policies <https://www.djangoproject.com/security/>`_
for further information.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
