In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-amazing_printUpgrade rubygem-hashieUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-oauthUpgrade rubygem-oauth-ttyUpgrade rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debuginfoUpgrade satellite-cloneUpgrade rubygem-little-pluggerUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-unfUpgrade rubygem-apipie-bindingsUpgrade rubygem-foreman_maintainUpgrade python39-pulp_manifestUpgrade rubygem-loggingUpgrade rubygem-snaky_hashUpgrade satellite-cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debugsourceUpgrade rubygem-gssapiUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debugsourceUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debuginfoUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade rubygem-ffi-debuginfoUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-multi_jsonUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-typesUpgrade rubygem-localeUpgrade rubygem-netrc | Nov 1, 2023 | Jul 3, 2023 |
| Debian | — | Upgrade python-django | Jul 24, 2023 | Jul 3, 2023 |
| Freebsd | — | Upgrade py38-django32Upgrade py39-django42Upgrade py39-django41Upgrade py38-django41Upgrade py311-django32Upgrade py311-django41Upgrade py38-django42Upgrade py310-django32Upgrade py311-django42Upgrade py39-django32Upgrade py310-django42Upgrade py310-django41 | Jul 3, 2023 | Jul 3, 2023 |
| Redhat_linux | — | Upgrade rubygem-hashieUpgrade python39-pulp_manifestUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_extUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-mime-typesUpgrade rubygem-clampUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-version_gemUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debuginfoUpgrade foreman-cliUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cliUpgrade rubygem-rest-clientUpgrade rubygem-little-pluggerUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-debugsourceUpgrade rubygem-netrcUpgrade rubygem-unicode-debuginfoUpgrade satellite-cloneUpgrade rubygem-fast_gettextUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-dataUpgrade satellite-maintainUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-snaky_hashUpgrade rubygem-loggingUpgrade rubygem-unfUpgrade rubygem-ffi-debugsourceUpgrade rubygem-gssapi | Nov 1, 2023 | Jul 3, 2023 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfo | Mar 5, 2024 | Jul 3, 2023 |
| Suse | — | Upgrade python3-djangoUpgrade python3-Django1 | Jul 12, 2023 | Jul 3, 2023 |
| Ubuntu | — | Upgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro)Upgrade python3-django | Jul 6, 2023 | Jul 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub