GitHub Advisoryadvisory · PyPI

GHSA-j3j3-jrfh-cm2w Django Denial-of-service possibility with strip_tags

HIGH Published 2022-05-14 Modified 2024-09-18 Official page ↗
Aliases
CVE-2015-2316
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2024-04-29

Affected packages

• PyPI Django: >= 1.6, < 1.6.11 → fixed in 1.6.11 • PyPI Django: >= 1.7, < 1.7.7 → fixed in 1.7.7 • PyPI Django: >= 1.8a1, < 1.8c1 → fixed in 1.8c1

Description

The `utils.html.strip_tags` function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.

Related

Alias · CVE (1)

  • CVE-2015-2316 The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References