Django 1.11.23 release notes — Django documentation
Django 1.11.23 release notes
August 1, 2019
Django 1.11.23 fixes security issues in 1.11.22.
CVE-2019-14232: Denial-of-service possibility in django.utils.text.Truncator
If django.utils.text.Truncator
’s chars()
and words()
methods were passed the html=True
argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars()
and words()
methods are used to implement the :tfilter:`truncatechars_html` and :tfilter:`truncatewords_html` template filters, which were thus vulnerable.
The regular expressions used by Truncator
have been simplified in order to avoid potential backtracking issues. As a consequence, trailing punctuation may now at times be included in the truncated output.
CVE-2019-14234: SQL injection possibility in key and index lookups for JSONField/HStoreField
:lookup:`Key and index lookups ` for JSONField and :lookup:`key lookups ` for HStoreField were subject to SQL injection, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs
passed to QuerySet.filter()
.
CVE-2019-14235: Potential memory exhaustion in django.utils.encoding.uri_to_iri()
If passed certain inputs, django.utils.encoding.uri_to_iri() could lead to significant memory usage due to excessive recursion when re-percent-encoding invalid UTF-8 octet sequences.
uri_to_iri()
now avoids recursion when re-percent-encoding invalid UTF-8 octet sequences.