CVE CyberSecurity Database News

CVE-2022-41323 In Django 3.2.x before 3.2.16, 4.0.x before 4.0.8, and 4.1.x before 4.1.2,

Poster -

Due to the complexity of the locale string and its regular expression treatment, a remote attacker could potentially exploit this issue to crash the application by supplying a locale that causes the regex parser to exhaust CPU resources. This issue was resolved in Django 3.2.17, 4.0.9, 4.1.3, and possibly other versions.


Django also provides a set of internationalized URL paths to reduce the amount of typing remote administrators have to do. Internally, these are stored as regular expressions, and a remote attacker could potentially exploit this issue to inject arbitrary characters into these regular expressions, bypassing validation of the path. This could potentially be leveraged to inject arbitrary scripts into the application or perform other attacks on the application. This issue was resolved in Django 4.1.4 by switching to a static compiled path for these URL paths.

Django provides a series of internationalized URL paths to reduce the amount of typing remote administrators have to do. Internally, these are stored as regular expressions, and a remote attacker could potentially exploit this issue to inject arbitrary characters into these regular expressions, bypassing validation of the path. This could potentially be leveraged to inject arbitrary scripts into the application or perform other attacks on the application. This issue was resolved in Django 4.1.4 by switching to a static compiled path for these URL paths

CVE-2023-41324

A remote attacker could potentially exploit this issue to crash the application by supplying a locale that causes the regex parser to exhaust CPU resources. This issue was resolved in Django 3.2.18, 4.0.9, 4.1.4, and possibly other versions.

Django also provides a set of internationalized URL paths to reduce the amount of typing remote administrators have to do. Internally, these are stored as regular expressions, and a remote attacker could potentially exploit this issue to inject arbitrary characters into these regular expressions, bypassing validation of the path. This could potentially be leveraged to inject arbitrary scripts into the application or perform other attacks on the application. This issue was resolved in Django 4.1.5 by switching to a static compiled path for these URL paths

CVE-2023-4089 1

A remote attacker could exploit this issue to cause a denial of service. This was fixed in Django 4.2.2.

Python Exception Handling

Python provides a set of exceptions for handling errors in your code. You can use the built-in functions raise and try/except to catch specific exceptions. The built-in function raise, when given an exception class name, will create a new instance of that class and raise it. This function is useful for creating custom error classes with custom behavior. The built-in function try/except is also useful as it catches specific exceptions and defers execution of your code until the exception is handled.

The issue was fixed in Django 4.1.4 by switching to a static compiled path for these URL paths

Django provides a set of internationalized URL paths to reduce the amount of typing remote administrators have to do. Internally, these are stored as regular expressions, and a remote attacker could potentially exploit this issue to inject arbitrary characters into these regular expressions, bypassing validation of the path. This could potentially be leveraged to inject arbitrary scripts into the application or perform other attacks on the application. This issue was resolved in Django 4.1.4 by switching to a static compiled path for these URL paths

Timeline

Published on: 10/16/2022 06:15:00 UTC
Last modified on: 11/24/2022 16:15:00 UTC

References