Inefficient regular expression complexity in Django - CVE-2023-36053

Vulnerability identifier: #VU77880

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36053

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions within EmailValidator and URLValidator. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Django
Debian Linux
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE OpenStack Cloud Crowbar
Fedora
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Ansible Automation Platform
Red Hat Satellite
Red Hat Update Infrastructure (RHUI)
python3-django (Ubuntu package)
python-django (Ubuntu package)
yggdrasil-worker-forwarder (Red Hat package)
libcomps (Red Hat package)
python-sqlparse (Red Hat package)
python-json-stream-rs-tokenizer (Red Hat package)
python-gnupg (Red Hat package)
python-inflection (Red Hat package)
python-defusedxml (Red Hat package)
libsolv (Red Hat package)
python-ecdsa (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
python-pulp-glue (Red Hat package)
python-drf-spectacular (Red Hat package)
python-drf-nested-routers (Red Hat package)
python-django-lifecycle (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
automation-eda-controller (Red Hat package)
createrepo_c (Red Hat package)
python-asyncio-throttle (Red Hat package)
python-brotli (Red Hat package)
python-et-xmlfile (Red Hat package)
python-django-readonly-field (Red Hat package)
rubygem-foreman_maintain (Red Hat package)
python-deprecated (Red Hat package)
python-drf-access-policy (Red Hat package)
python-xlwt (Red Hat package)
python-aiosignal (Red Hat package)
pulpcore-selinux (Red Hat package)
python-frozenlist (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
python-aiohttp-xmlrpc (Red Hat package)
python-jq (Red Hat package)
python-yarl (Red Hat package)
python-Django1
python-Django
python-wrapt (Red Hat package)
python-markuppy (Red Hat package)
rubygem-git (Red Hat package)
python-opentelemetry_exporter_otlp_proto_common (Red Hat package)
python-opentelemetry_api (Red Hat package)
python-opentelemetry_exporter_otlp (Red Hat package)
python-opentelemetry_proto (Red Hat package)
python-opentelemetry_sdk (Red Hat package)
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package)
python-opentelemetry_exporter_otlp_proto_http (Red Hat package)
python-productmd (Red Hat package)
python-grpcio (Red Hat package)
python-googleapis-common-protos (Red Hat package)
python-urlman (Red Hat package)
python-aioredis (Red Hat package)
python-xlrd (Red Hat package)
python3-Django
python-markupsafe (Red Hat package)
python-backoff (Red Hat package)
python-django-help
python-django
python-django (Debian package)
python-json-stream (Red Hat package)
python-pyjwt (Red Hat package)
python-pygtrie (Red Hat package)
python-pulp-container (Red Hat package)
python-pulp-container-client (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python3x-requests (Red Hat package)
python-requests (Red Hat package)
python-aiodns (Red Hat package)
python-django-import-export (Red Hat package)
python-openpyxl (Red Hat package)
python-pyparsing (Red Hat package)
python-jinja2 (Red Hat package)
python-psycopg (Red Hat package)
python-dynaconf (Red Hat package)
python-gitpython (Red Hat package)
python-django3
python3x-django (Red Hat package)
python-django (Red Hat package)
python-django-guid (Red Hat package)
python-tablib (Red Hat package)
python-types-cryptography (Red Hat package)
python-zipp (Red Hat package)
foreman (Red Hat package)
python-asgiref
foreman-installer (Red Hat package)
python-asgiref (Red Hat package)
python-aiohttp (Red Hat package)
python-djangorestframework (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulpcore (Red Hat package)
python-pulp-rpm (Red Hat package)
python-pulp-rpm-client (Red Hat package)
python-pulpcore-client (Red Hat package)
python-async-timeout (Red Hat package)
python-uritemplate (Red Hat package)
python-pycares (Red Hat package)
python3-django
python3-django-bash-completion
python3-django-doc
python-redis (Red Hat package)
automation-controller (Red Hat package)
rubygem-katello (Red Hat package)
python-typing-extensions (Red Hat package)
python3x-rsa (Red Hat package)
python-rsa (Red Hat package)
rhui-tools (Red Hat package)
rhui-installer (Red Hat package)
python-jsonschema (Red Hat package)
python-protobuf (Red Hat package)
python-whitenoise (Red Hat package)
python-importlib-metadata (Red Hat package)
python-multidict (Red Hat package)
satellite (Red Hat package)
rubygem-foreman_rh_cloud (Red Hat package)
puppet-agent (Red Hat package)
python-click (Red Hat package)
rubygem-foreman_theme_satellite (Red Hat package)
python-gunicorn (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python-aiofiles (Red Hat package)
python-django-filter (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
python-pytz (Red Hat package)
python-uuid6 (Red Hat package)
python-diff-match-patch (Red Hat package)
Cloud Pak for Network Automation

Install updates from vendor's website.

Django - addressed in versions 3.2.20, 4.1.10, 4.2.3
Red Hat Satellite - addressed in versions 6.13.5, 6.14
python3-django (Ubuntu package) - addressed in versions Ubuntu Pro, 2:2.2.12-1ubuntu0.18, 2:3.2.12-2ubuntu1.7, 3:3.2.15-1ubuntu1.4, 3:3.2.18-1ubuntu0.3
python-django (Ubuntu package) - update to Ubuntu Pro
yggdrasil-worker-forwarder (Red Hat package) - update to 0.0.3-1.el8sat
libcomps (Red Hat package) - update to 0.1.18-8.el8ui
python-sqlparse (Red Hat package) - update to 0.4.4-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package) - update to 0.4.25-3.el8ui
python-gnupg (Red Hat package) - update to 0.5.0-4.el8ui
python-inflection (Red Hat package) - update to 0.5.1-6.el8ui
python-defusedxml (Red Hat package) - update to 0.7.1-6.el8ui
libsolv (Red Hat package) - update to 0.7.22-6.el8ui
python-ecdsa (Red Hat package) - update to 0.18.0-4.el8ui
python-pyrsistent (Red Hat package) - update to 0.18.1-5.el8ui
python-future (Red Hat package) - update to 0.18.3-4.el8ui
python-pulp-glue (Red Hat package) - update to 0.21.2-3.el8ui
python-drf-spectacular (Red Hat package) - update to 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package) - update to 0.93.4-5.el8ui
python-django-lifecycle (Red Hat package) - update to 1.0.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package) - update to 1.0.0-7.el8ui
automation-eda-controller (Red Hat package) - addressed in versions 1.0.1-1.el8ap, 1.0.1-1.el9ap
createrepo_c (Red Hat package) - update to 1.0.2-5.el8ui
python-asyncio-throttle (Red Hat package) - update to 1.0.2-6.el8ui
python-brotli (Red Hat package) - update to 1.0.9-5.el8ui
python-et-xmlfile (Red Hat package) - update to 1.1.0-5.el8ui
python-django-readonly-field (Red Hat package) - update to 1.1.2-3.el8ui
rubygem-foreman_maintain (Red Hat package) - update to 1.2.12-1.el8sat
python-deprecated (Red Hat package) - update to 1.2.13-4.el8ui
python-drf-access-policy (Red Hat package) - update to 1.3.0-3.el8ui
python-xlwt (Red Hat package) - update to 1.3.0-6.el8ui
python-aiosignal (Red Hat package) - update to 1.3.1-4.el8ui
pulpcore-selinux (Red Hat package) - addressed in versions 1.3.3-1.el8pc, 2.0.1-1.el8ui
python-frozenlist (Red Hat package) - update to 1.3.3-4.el8ui
python-odfpy (Red Hat package) - update to 1.4.1-9.el8ui
python-pyjwkest (Red Hat package) - update to 1.4.2-8.el8ui
python-url-normalize (Red Hat package) - update to 1.4.3-7.el8ui
python-aiohttp-xmlrpc (Red Hat package) - update to 1.5.0-5.el8ui
python-jq (Red Hat package) - update to 1.6.0-3.el8ui
python-yarl (Red Hat package) - update to 1.8.2-4.el8ui
python-Django1 - update to 1.11.29-3.47.1
python-Django - update to 1.11.29-3.48.1
python-wrapt (Red Hat package) - update to 1.14.1-4.el8ui
python-markuppy (Red Hat package) - update to 1.14-6.el8ui
rubygem-git (Red Hat package) - update to 1.18.0-1.el8sat
python-opentelemetry_exporter_otlp_proto_common (Red Hat package) - update to 1.19.0-3.el8ui
python-opentelemetry_api (Red Hat package) - update to 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_sdk (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package) - update to 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package) - update to 1.19.0-5.el8ui
python-productmd (Red Hat package) - update to 1.33-6.el8ui
python-grpcio (Red Hat package) - update to 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package) - update to 1.59.1-4.el8ui
python-urlman (Red Hat package) - update to 2.0.1-4.el8ui
python-aioredis (Red Hat package) - update to 2.0.1-5.el8ui
python-xlrd (Red Hat package) - update to 2.0.1-8.el8ui
python3-Django - update to 2.0.7-150000.1.11.1
python-markupsafe (Red Hat package) - update to 2.1.2-4.el8ui
python-backoff (Red Hat package) - update to 2.2.1-4.el8ui
python3-Django - update to 2.2.27-6
python-django-help - update to 2.2.27-6
python-django - update to 2.2.27-6
python-django (Debian package) - addressed in versions 2:2.2.28-1~deb11u2, 3:3.2.19-1+deb12u1
python-json-stream (Red Hat package) - update to 2.3.2-4.el8ui
python-pyjwt (Red Hat package) - update to 2.5.0-4.el8ui
python-pygtrie (Red Hat package) - update to 2.5.0-4.el8ui
Cloud Pak for Network Automation - update to 2.6.1
python-pulp-container (Red Hat package) - update to 2.16.4-1.el8ui
python-pulp-container-client (Red Hat package) - update to 2.16.4-1.0.1.el8ui
ansible-collection-community-crypto (Red Hat package) - update to 2.18.0-1.el8ui
python3x-requests (Red Hat package) - update to 2.31.0-1.el8ap
python-requests (Red Hat package) - update to 2.31.0-1.el9ap
python-aiodns (Red Hat package) - update to 3.0.0-6.el8ui
python-django-import-export (Red Hat package) - update to 3.1.0-3.el8ui
python-openpyxl (Red Hat package) - update to 3.1.0-4.el8ui
python-pyparsing (Red Hat package) - update to 3.1.1-3.el8ui
python-jinja2 (Red Hat package) - update to 3.1.3-1.el8ui
python-psycopg (Red Hat package) - update to 3.1.9-4.el8ui
python-dynaconf (Red Hat package) - update to 3.1.12-3.el8ui
python-gitpython (Red Hat package) - update to 3.1.32-1.el8pc
python-django3 - update to 3.2.20-1.el8
python3x-django (Red Hat package) - update to 3.2.20-1.el8ap
python-django (Red Hat package) - addressed in versions 3.2.20-1.el9ap, 3.2.21-1.el8pc, 4.2.11-1.el8ui
python-django-guid (Red Hat package) - update to 3.3.0-4.el8ui
python-tablib (Red Hat package) - update to 3.3.0-4.el8ui
python-types-cryptography (Red Hat package) - update to 3.3.23.2-4.el8ui
python-zipp (Red Hat package) - update to 3.4.0-7.el8ui
foreman (Red Hat package) - update to 3.5.1.23-1.el8sat
python-asgiref - addressed in versions 3.5.2-1.fc37, 3.5.2-1.fc38
foreman-installer (Red Hat package) - update to 3.5.2.4-1.el8sat
python-asgiref (Red Hat package) - update to 3.6.0-4.el8ui
python-aiohttp (Red Hat package) - update to 3.9.2-1.el8ui
python-djangorestframework (Red Hat package) - update to 3.14.0-3.el8ui
python-pycryptodomex (Red Hat package) - update to 3.14.1-5.el8ui
python-pulpcore (Red Hat package) - addressed in versions 3.21.18-1.el8pc, 3.39.11-1.el8ui
python-pulp-rpm (Red Hat package) - update to 3.23.0-2.el8ui
python-pulp-rpm-client (Red Hat package) - update to 3.23.0-2.0.1.el8ui
python-pulpcore-client (Red Hat package) - update to 3.39.7-1.0.1.el8ui
python-async-timeout (Red Hat package) - update to 4.0.2-5.el8ui
python-uritemplate (Red Hat package) - update to 4.1.1-5.el8ui
python-pycares (Red Hat package) - update to 4.1.2-5.el8ui
python-django - addressed in versions 4.1.12-1.fc37, 4.1.12-1.fc38, 4.2.6-1.fc39
python3-django - update to 4.2.7-1
python3-django-bash-completion - update to 4.2.7-1
python3-django-doc - update to 4.2.7-1
python-redis (Red Hat package) - update to 4.3.4-4.el8ui
automation-controller (Red Hat package) - addressed in versions 4.4.2-1.el8ap, 4.4.2-1.el9ap
rubygem-katello (Red Hat package) - update to 4.7.0.33-1.el8sat
python-typing-extensions (Red Hat package) - update to 4.7.1-4.el8ui
python3x-rsa (Red Hat package) - update to 4.7.2-1.el8ap
python-rsa (Red Hat package) - update to 4.7.2-1.el9ap
Red Hat Update Infrastructure (RHUI) - update to 4.8.0
rhui-tools (Red Hat package) - update to 4.8.0.1-1.el8ui
rhui-installer (Red Hat package) - update to 4.8.0.2-1.el8ui
python-jsonschema (Red Hat package) - update to 4.10.3-3.el8ui
python-protobuf (Red Hat package) - update to 4.21.6-4.el8ui
python-whitenoise (Red Hat package) - update to 6.0.0-4.el8ui
python-importlib-metadata (Red Hat package) - update to 6.0.1-4.el8ui
python-multidict (Red Hat package) - update to 6.0.4-4.el8ui
satellite (Red Hat package) - update to 6.13.5-1.el8sat
rubygem-foreman_rh_cloud (Red Hat package) - update to 7.0.48-1.el8sat
puppet-agent (Red Hat package) - update to 7.26.0-3.el8sat
python-click (Red Hat package) - update to 8.1.3-4.el8ui
rubygem-foreman_theme_satellite (Red Hat package) - update to 11.0.0.6-1.el8sat
python-gunicorn (Red Hat package) - update to 20.1.0-7.1.2.el8ui
python-packaging (Red Hat package) - update to 21.3-5.el8ui
python-attrs (Red Hat package) - update to 21.4.0-5.el8ui
python-aiofiles (Red Hat package) - update to 22.1.0-4.el8ui
python-django-filter (Red Hat package) - update to 23.2-3.el8ui
python3x-cryptography (Red Hat package) - update to 38.0.4-2.el8ap
python-cryptography (Red Hat package) - addressed in versions 38.0.4-2.el9ap, 41.0.6-1.el8ui
python-pytz (Red Hat package) - update to 2022.2.1-5.el8ui
python-uuid6 (Red Hat package) - update to 2023.5.2-4.el8ui
python-diff-match-patch (Red Hat package) - update to 20200713-6.el8ui

• https://www.djangoproject.com/weblog/2023/jul/03/security-releases/

• Regular expression denial of service in Django
• Ubuntu update for python-django
• SUSE update for python-Django
• Ubuntu update for python-django
• SUSE update for python-Django
• Debian update for python-django
• SUSE update for python-Django1
• Fedora EPEL 8 update for python-django3
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Fedora 39 update for python-django
• Fedora 38 update for python-asgiref, python-django
• Fedora 37 update for python-asgiref, python-django
• Multiple vulnerabilities in Red Hat Satellite
• Multiple vulnerabilities in Red Hat Satellite 6.14
• openEuler update for python-django
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• Anolis OS update for python-django