In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicodeUpgrade python39-pulp_manifestUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debugsourceUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-loggingUpgrade rubygem-http-cookieUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-typesUpgrade rubygem-localeUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_extUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-jwtUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_googleUpgrade foreman-cliUpgrade rubygem-domain_nameUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-amazing_printUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauthUpgrade rubygem-clampUpgrade rubygem-hammer_cliUpgrade rubygem-rest-clientUpgrade rubygem-hashieUpgrade rubygem-foreman_maintainUpgrade rubygem-highlineUpgrade rubygem-unfUpgrade rubygem-powerbarUpgrade rubygem-little-pluggerUpgrade satellite-clone | Nov 1, 2023 | Jul 3, 2023 |
| Debian | — | Upgrade python-django | Jul 24, 2023 | Jul 3, 2023 |
| Freebsd | — | Upgrade py310-django32Upgrade py311-django32Upgrade py310-django41Upgrade py310-django42Upgrade py39-django32Upgrade py311-django42Upgrade py311-django41Upgrade py38-django42Upgrade py39-django41Upgrade py38-django41Upgrade py38-django32Upgrade py39-django42 | Jul 3, 2023 | Jul 3, 2023 |
| Redhat_linux | — | Upgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-gssapiUpgrade rubygem-oauth-ttyUpgrade rubygem-rest-clientUpgrade rubygem-multi_jsonUpgrade rubygem-fast_gettextUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-http-acceptUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-maintainUpgrade rubygem-snaky_hashUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-netrcUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-jwtUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-mime-typesUpgrade rubygem-unicode-display_widthUpgrade rubygem-http-cookieUpgrade rubygem-oauthUpgrade foreman-cliUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffi-debuginfoUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-clampUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-version_gemUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_extUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifest | Nov 1, 2023 | Jul 3, 2023 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfo | Mar 5, 2024 | Jul 3, 2023 |
| Suse | — | Upgrade python3-djangoUpgrade python3-Django1 | Jul 12, 2023 | Jul 3, 2023 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro) | Jul 6, 2023 | Jul 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub