Headline
Ubuntu Security Notice USN-6674-1
Ubuntu Security Notice 6674-1 - Seokchan Yoon discovered that the Django Truncator function incorrectly handled very long HTML input. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.
==========================================================================
Ubuntu Security Notice USN-6674-1
March 04, 2024
python-django vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Django could be made to consume resources or crash if it received specially
crafted network traffic.
Software Description:
- python-django: High-level Python web development framework
Details:
Seokchan Yoon discovered that the Django Truncator function incorrectly
handled very long HTML input. A remote attacker could possibly use this
issue to cause Django to consume resources, leading to a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
python3-django 3:4.2.4-1ubuntu2.2
Ubuntu 22.04 LTS:
python3-django 2:3.2.12-2ubuntu1.11
Ubuntu 20.04 LTS:
python3-django 2:2.2.12-1ubuntu0.22
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6674-1
CVE-2024-27351
Package Information:
https://launchpad.net/ubuntu/+source/python-django/3:4.2.4-1ubuntu2.2
https://launchpad.net/ubuntu/+source/python-django/2:3.2.12-2ubuntu1.11
https://launchpad.net/ubuntu/+source/python-django/2:2.2.12-1ubuntu0.22
Related news
Red Hat Security Advisory 2024-3781-03 - An update is now available for Red Hat Ansible Automation Platform 2.4. Issues addressed include HTTP request smuggling, buffer overflow, code execution, cross site scripting, denial of service, memory exhaustion, null pointer, and password leak vulnerabilities.
Red Hat Security Advisory 2024-1878-03 - An updated version of Red Hat Update Infrastructure is now available. RHUI 4.8 fixes several security an operational bugs, adds some new features and upgrades the underlying Pulp to a newer version. Issues addressed include HTTP request smuggling, crlf injection, denial of service, and traversal vulnerabilities.
Red Hat Security Advisory 2024-1640-03 - An update is now available for Red Hat Ansible Automation Platform 2.4. Issues addressed include HTTP request smuggling, denial of service, local file inclusion, memory leak, and traversal vulnerabilities.
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
Ubuntu Security Notice 6674-2 - USN-6674-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 18.04 LTS. Seokchan Yoon discovered that the Django Truncator function incorrectly handled very long HTML input. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.