Skip to content
OpenAdvisories
Medium · 6.5 CVE-2024-39317 EUVD-2024-0186GHSA-jmp3-39vp-fwg8PYSEC-2024-86

Wagtail regular expression denial-of-service via search query parsing

Published Jul 11, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.

Affected products

VendorProductAffectedFixed
wagtail wagtail >= 2.0, < 5.2.6, >= 6.0, < 6.0.6, >= 6.1, < 6.1.3 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI wagtail >= 6.0, < 6.0.6 6.0.6 GHSA-jmp3-39vp-fwg8
PyPI wagtail >= 6.1, < 6.1.3 6.1.3 GHSA-jmp3-39vp-fwg8
PyPI wagtail >= 2.0, < 5.2.6 5.2.6 GHSA-jmp3-39vp-fwg8
PyPI wagtail >= 6.0, < 6.0.6 · >= 6.1, < 6.1.3 · >= 2.0, < 5.2.6 6.0.6, 6.1.3, 5.2.6 PYSEC-2024-86

References