Summary
Benjamin Balder Bach discovered that Django incorrectly handled certain
internationalized URLs. A remote attacker could possibly use this issue to
cause Django to crash, resulting in a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | python-django | 2:2.2.12-1ubuntu0.14 |
| Ubuntu · 22.04 LTS 22.04:LTS | python-django | 2:3.2.12-2ubuntu1.3 |
Vulnerabilities 1
-
High 7.5
Django denial-of-service vulnerability in internationalized URLs
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
References
-
report
https://ubuntu.com/security/CVE-2022-41323