-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 05 Jun 2025 15:40:11 -0700
Source: python-django
Architecture: source
Version: 2:2.2.28-1~deb11u7
Distribution: bullseye-security
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Closes: 1051226 1104872 1107282
Changes:
python-django (2:2.2.28-1~deb11u7) bullseye-security; urgency=high
.
* CVE-2025-48432: Potential log injection via unescaped request path.
.
Django's internal HTTP response logging used request.path directly,
allowing control characters (e.g. newlines or ANSI escape sequences) to
be written unescaped into logs. This could enable log injection or
forgery, letting attackers manipulate log appearance or structure,
especially in logs processed by external systems or viewed in terminals.
(Closes: #1107282)
.
* CVE-2025-32873: Denial-of-service possibility in strip_tags()
.
django.utils.html.strip_tags() would be slow to evaluate certain inputs
containing large sequences of incomplete HTML tags. This function is used
to implement the striptags template filter, which was therefore also
vulnerable. strip_tags() now raises a SuspiciousOperation exception if it
encounters an unusually large number of unclosed opening tags.
(Closes: #1104872)
.
* CVE-2023-41164: Potential denial of service vulnerability in
django.utils.encoding.uri_to_iri(). This method was subject to potential
denial of service attack via certain inputs with a very large number of
Unicode characters. (Closes: #1051226)
.
* CVE-2023-43665: Address a denial-of-service possibility in
django.utils.text.Truncator.
.
Following the fix for CVE-2019-14232, the regular expressions used in the
implementation of django.utils.text.Truncator’s chars() and words()
methods (with html=True) were revised and improved. However, these
regular expressions still exhibited linear backtracking complexity, so
when given a very long, potentially malformed HTML input, the evaluation
would still be slow, leading to a potential denial of service
vulnerability.
.
The chars() and words() methods are used to implement the
truncatechars_html and truncatewords_html template filters, which were
thus also vulnerable.
.
The input processed by Truncator, when operating in HTML mode, has been
limited to the first five million characters in order to avoid potential
performance and memory issues.
.
* CVE-2024-24680: Potential denial-of-service in intcomma template filter.
The intcomma template filter was subject to a potential denial-of-service
attack when used with very long strings.
.
* CVE-2024-27351: Fix a potential regular expression denial-of-service
(ReDoS) attack in django.utils.text.Truncator.words. This method (with
html=True) and the truncatewords_html template filter were subject to a
potential regular expression denial-of-service attack via a suitably
crafted string. This is, in part, a follow up to CVE-2019-14232 and
CVE-2023-43665.
Checksums-Sha1:
3c3a02df5744afe7fc781794e2a1c4879ca1c6a0 2811 python-django_2.2.28-1~deb11u7.dsc
046a08b5f2e54af1439bd45771707e1570966e48 52680 python-django_2.2.28-1~deb11u7.debian.tar.xz
1b56315f21be1c51c231d13e23482c8281173de5 14326 python-django_2.2.28-1~deb11u7_amd64.buildinfo
Checksums-Sha256:
f1ad665823c648e41198f4db2e7253eca689cafcb029a4eaf98bc1d4a9844800 2811 python-django_2.2.28-1~deb11u7.dsc
72f95b4f95cb34c0e8f3c59c42e642b3e664533aff4efb273effcd0ddbe39a71 52680 python-django_2.2.28-1~deb11u7.debian.tar.xz
e83db38bd58414defd6ad0a59e2c44da2f16f7a7ff74664f9f19f740983b769f 14326 python-django_2.2.28-1~deb11u7_amd64.buildinfo
Files:
41cc50a404ba85283c4dec2f2f76d953 2811 python optional python-django_2.2.28-1~deb11u7.dsc
85ac238a34ca99d098110056db4c7aaa 52680 python optional python-django_2.2.28-1~deb11u7.debian.tar.xz
60b592562f9789de461b8d2e63d3e00b 14326 python optional python-django_2.2.28-1~deb11u7_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmhCITYACgkQHpU+J9Qx
HljqGRAAxBer0PE9V45qI7EiQR0PMuebe9ih9JxgLDdDXFJS4zu7s3vPpTyvAUh/
ZSlCxl2hDlo/EjD/BVnd+d5/r9CcvYcijNLJn5ypfg2++hXuglwac+GWGN3iUbRZ
1zMJuZ/xvBVy+QayTPzxi9UOQhIzrjCe+7TW5nooodixeR4ReZ2MgMwb8M4TKA8m
fA7HqJH9CaghDj+bKUUE6lDlzeY5NVgjuSGW4vH+Gt5gqX15nkYiT1L6A/nC2rBm
XMlq9etCFaQYV50rsO0bubpxV11NYiobrqXiAegbjuAuOyMWEELJrJuNvpBxJD9k
BbKI75Ot3fthKzv3jrHdjXOFrsPblzTZmC1eZyE9MHQf/wBPJGaKUPR2dOvCtNG6
ZJeJcPwT3A5ZA5E36lLzdXkVaj+6VJJEfD1uNXj4WK8LkRjF5KeK8lu0GEdQXntj
Tx/VmyaTuMxb6Byvo5aXtSg4EQQWjxsgTQfrAIhaRHjIxXcNO1XZ4MjsS3A6n525
Ir/4pGauCnM9jtdtCU+4JPU1TjAgJ3qflJ89G0h5/T/TBUwTvrBmKEglnMGiYU+N
1yUfCxbnnLxhgB2/HuFEOu4/I2x9I2cLTfml3wRn4lhVaEuryp6oaegQIjufKDm8
xZycqh7RoPJderkNzViFtX7Nr1SpRsyw7Y73mv+icrhkyXIt0co=
=6QrJ
-----END PGP SIGNATURE-----
Attachment:
pgphxyuiuIJET.pgp
Description: PGP signature