Inefficient regular expression complexity in Django - CVE-2024-27351

Vulnerability identifier: #VU87033

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-27351

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions in django.utils.text.Truncator.words(). A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Django
Debian Linux
Gentoo Linux
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
Fedora
Ubuntu
openEuler
Anolis OS
Oracle Solaris
Nautobot
Storage Defender - Resiliency Service
Cloud Pak for Network Automation
Maximo Application Suite - Edge Data Collector
python-django (Ubuntu package)
python3-django (Ubuntu package)
libcomps (Red Hat package)
python-sqlparse (Red Hat package)
python-json-stream-rs-tokenizer (Red Hat package)
python3x-sqlparse (Red Hat package)
python-gnupg (Red Hat package)
python-inflection (Red Hat package)
python-defusedxml (Red Hat package)
libsolv (Red Hat package)
python-ecdsa (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
python-pulp-glue (Red Hat package)
python-drf-spectacular (Red Hat package)
python-drf-nested-routers (Red Hat package)
python-django-lifecycle (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
createrepo_c (Red Hat package)
python-asyncio-throttle (Red Hat package)
ansible-rulebook (Red Hat package)
automation-eda-controller (Red Hat package)
python-brotli (Red Hat package)
python-et-xmlfile (Red Hat package)
python-django-readonly-field (Red Hat package)
python-deprecated (Red Hat package)
python-drf-access-policy (Red Hat package)
python-xlwt (Red Hat package)
python-aiosignal (Red Hat package)
python-frozenlist (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
receptor (Red Hat package)
python-aiohttp-xmlrpc (Red Hat package)
python-jq (Red Hat package)
python-yarl (Red Hat package)
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
python-Django1
python-Django
python-markuppy (Red Hat package)
python-wrapt (Red Hat package)
python-opentelemetry_api (Red Hat package)
python-opentelemetry_exporter_otlp_proto_common (Red Hat package)
python-opentelemetry_exporter_otlp (Red Hat package)
python-opentelemetry_proto (Red Hat package)
python-opentelemetry_sdk (Red Hat package)
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package)
python-opentelemetry_exporter_otlp_proto_http (Red Hat package)
python-productmd (Red Hat package)
python-grpcio (Red Hat package)
python-googleapis-common-protos (Red Hat package)
pulpcore-selinux (Red Hat package)
python-urlman (Red Hat package)
python-aioredis (Red Hat package)
python-xlrd (Red Hat package)
python-markupsafe (Red Hat package)
python-backoff (Red Hat package)
python-django (Red Hat package)
python3-Django
python-django-help
python-django
python-json-stream (Red Hat package)
ansible-runner (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
python-pyjwt (Red Hat package)
python-pygtrie (Red Hat package)
ansible-core (Red Hat package)
python-pulp-container (Red Hat package)
python-pulp-container-client (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python3x-requests (Red Hat package)
python-requests (Red Hat package)
python-aiodns (Red Hat package)
python-django-import-export (Red Hat package)
python-openpyxl (Red Hat package)
python-pyparsing (Red Hat package)
python-jinja2 (Red Hat package)
python3x-jinja2 (Red Hat package)
python-psycopg (Red Hat package)
python-dynaconf (Red Hat package)
python-django3
python-tablib (Red Hat package)
python-django-guid (Red Hat package)
python-types-cryptography (Red Hat package)
python-zipp (Red Hat package)
python-asgiref (Red Hat package)
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python-aiohttp (Red Hat package)
python3x-aiohttp (Red Hat package)
python-djangorestframework (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulp-rpm (Red Hat package)
python-pulp-rpm-client (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python-pulpcore-client (Red Hat package)
python-async-timeout (Red Hat package)
python-uritemplate (Red Hat package)
python-pycares (Red Hat package)
python3-django-doc
python3-django-bash-completion
python3-django
python3x-django (Red Hat package)
python-redis (Red Hat package)
automation-controller (Red Hat package)
python-typing-extensions (Red Hat package)
rhui-tools (Red Hat package)
rhui-installer (Red Hat package)
python3x-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
python-jsonschema (Red Hat package)
python-protobuf (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
python-whitenoise (Red Hat package)
python-importlib-metadata (Red Hat package)
python-multidict (Red Hat package)
python-click (Red Hat package)
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
venv-openstack-horizon-x86_64
venv-openstack-horizon-hpe-x86_64
python-gunicorn (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python3x-gunicorn (Red Hat package)
python-aiofiles (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python-django-filter (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
python-cryptography (Red Hat package)
python3x-cryptography (Red Hat package)
python-pytz (Red Hat package)
python-uuid6 (Red Hat package)
python-diff-match-patch (Red Hat package)
dev-python/django
python-django (Debian package)
Red Hat Update Infrastructure (RHUI)
Red Hat OpenStack

Install updates from vendor's website.

Django - addressed in versions 3.2.25, 4.2.11, 5.0.3
Nautobot - addressed in versions 1.6.16, 2.1.9
Storage Defender - Resiliency Service - update to 2.0.5
Cloud Pak for Network Automation - update to 2.7.1
python-django (Ubuntu package) - update to 1:1.11.11-1ubuntu1.21+esm4
python3-django (Ubuntu package) - addressed in versions 1:1.11.11-1ubuntu1.21+esm4, 2:2.2.12-1ubuntu0.22, 2:3.2.12-2ubuntu1.11, 3:4.2.4-1ubuntu2.2
libcomps (Red Hat package) - update to 0.1.18-8.el8ui
python-sqlparse (Red Hat package) - addressed in versions 0.4.4-3.el8ui, 0.5.0-1.el9ap
python-json-stream-rs-tokenizer (Red Hat package) - update to 0.4.25-3.el8ui
python3x-sqlparse (Red Hat package) - update to 0.5.0-1.el8ap
python-gnupg (Red Hat package) - update to 0.5.0-4.el8ui
python-inflection (Red Hat package) - update to 0.5.1-6.el8ui
python-defusedxml (Red Hat package) - update to 0.7.1-6.el8ui
libsolv (Red Hat package) - update to 0.7.22-6.el8ui
python-ecdsa (Red Hat package) - update to 0.18.0-4.el8ui
python-pyrsistent (Red Hat package) - update to 0.18.1-5.el8ui
python-future (Red Hat package) - update to 0.18.3-4.el8ui
python3x-pulp-ansible (Red Hat package) - update to 0.20.7-1.el8ap
python-pulp-ansible (Red Hat package) - update to 0.20.7-1.el9ap
python-pulp-glue (Red Hat package) - update to 0.21.2-3.el8ui
python-drf-spectacular (Red Hat package) - update to 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package) - update to 0.93.4-5.el8ui
python-django-lifecycle (Red Hat package) - update to 1.0.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package) - update to 1.0.0-7.el8ui
createrepo_c (Red Hat package) - update to 1.0.2-5.el8ui
python-asyncio-throttle (Red Hat package) - update to 1.0.2-6.el8ui
ansible-rulebook (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
python-brotli (Red Hat package) - update to 1.0.9-5.el8ui
python-et-xmlfile (Red Hat package) - update to 1.1.0-5.el8ui
python-django-readonly-field (Red Hat package) - update to 1.1.2-3.el8ui
python-deprecated (Red Hat package) - update to 1.2.13-4.el8ui
python-drf-access-policy (Red Hat package) - update to 1.3.0-3.el8ui
python-xlwt (Red Hat package) - update to 1.3.0-6.el8ui
python-aiosignal (Red Hat package) - update to 1.3.1-4.el8ui
python-frozenlist (Red Hat package) - update to 1.3.3-4.el8ui
python-odfpy (Red Hat package) - update to 1.4.1-9.el8ui
python-pyjwkest (Red Hat package) - update to 1.4.2-8.el8ui
python-url-normalize (Red Hat package) - update to 1.4.3-7.el8ui
receptor (Red Hat package) - addressed in versions 1.4.5-1.el8ap, 1.4.5-1.el9ap, 1.4.8-1.el8ap, 1.4.8-1.el9ap
python-aiohttp-xmlrpc (Red Hat package) - update to 1.5.0-5.el8ui
python-jq (Red Hat package) - update to 1.6.0-3.el8ui
python-yarl (Red Hat package) - update to 1.8.2-4.el8ui
python3x-pydantic (Red Hat package) - update to 1.10.15-1.el8ap
python-pydantic (Red Hat package) - update to 1.10.15-1.el9ap
python-Django1 - update to 1.11.29-3.61.1
python-Django - update to 1.11.29-3.62.1
python-markuppy (Red Hat package) - update to 1.14-6.el8ui
python-wrapt (Red Hat package) - update to 1.14.1-4.el8ui
python-opentelemetry_api (Red Hat package) - update to 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package) - update to 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_sdk (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package) - update to 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package) - update to 1.19.0-5.el8ui
python-productmd (Red Hat package) - update to 1.33-6.el8ui
python-grpcio (Red Hat package) - update to 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package) - update to 1.59.1-4.el8ui
pulpcore-selinux (Red Hat package) - update to 2.0.1-1.el8ui
python-urlman (Red Hat package) - update to 2.0.1-4.el8ui
python-aioredis (Red Hat package) - update to 2.0.1-5.el8ui
python-xlrd (Red Hat package) - update to 2.0.1-8.el8ui
python-markupsafe (Red Hat package) - update to 2.1.2-4.el8ui
python-backoff (Red Hat package) - update to 2.2.1-4.el8ui
python-django (Red Hat package) - addressed in versions 2.2.24-9.el9ost, 4.2.11-1.el8ui, 4.2.11-1.el9ap
python3-Django - update to 2.2.27-11
python-django-help - update to 2.2.27-11
python-django - update to 2.2.27-11
python-json-stream (Red Hat package) - update to 2.3.2-4.el8ui
ansible-runner (Red Hat package) - addressed in versions 2.3.6-1.el8ap, 2.3.6-1.el9ap
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-7.1.el8ap, 2.4-7.1.el9ap
python-pyjwt (Red Hat package) - update to 2.5.0-4.el8ui
python-pygtrie (Red Hat package) - update to 2.5.0-4.el8ui
ansible-core (Red Hat package) - addressed in versions 2.15.10-1.el8ap, 2.15.10-1.el9ap, 2.15.11-1.el8ap, 2.15.11-1.el9ap
python-pulp-container (Red Hat package) - update to 2.16.4-1.el8ui
python-pulp-container-client (Red Hat package) - update to 2.16.4-1.0.1.el8ui
ansible-collection-community-crypto (Red Hat package) - update to 2.18.0-1.el8ui
python3x-requests (Red Hat package) - update to 2.32.2-1.el8ap
python-requests (Red Hat package) - update to 2.32.2-1.el9ap
python-aiodns (Red Hat package) - update to 3.0.0-6.el8ui
python-django-import-export (Red Hat package) - update to 3.1.0-3.el8ui
python-openpyxl (Red Hat package) - update to 3.1.0-4.el8ui
python-pyparsing (Red Hat package) - update to 3.1.1-3.el8ui
python-jinja2 (Red Hat package) - addressed in versions 3.1.3-1.el8ui, 3.1.4-1.el9ap
python3x-jinja2 (Red Hat package) - update to 3.1.4-1.el8ap
python-psycopg (Red Hat package) - update to 3.1.9-4.el8ui
python-dynaconf (Red Hat package) - update to 3.1.12-3.el8ui
python-django3 - addressed in versions 3.2.25-1.el9, 3.2.25-2.fc38
python-tablib (Red Hat package) - update to 3.3.0-4.el8ui
python-django-guid (Red Hat package) - update to 3.3.0-4.el8ui
python-types-cryptography (Red Hat package) - update to 3.3.23.2-4.el8ui
python-zipp (Red Hat package) - update to 3.4.0-7.el8ui
python-asgiref (Red Hat package) - update to 3.6.0-4.el8ui
python3x-idna (Red Hat package) - update to 3.7-1.el8ap
python-idna (Red Hat package) - update to 3.7-1.el9ap
python-aiohttp (Red Hat package) - addressed in versions 3.9.2-1.el8ui, 3.9.3-1.el9ap, 3.9.5-1.el9ap
python3x-aiohttp (Red Hat package) - addressed in versions 3.9.3-1.el8ap, 3.9.5-1.el8ap
python-djangorestframework (Red Hat package) - update to 3.14.0-3.el8ui
python-pycryptodomex (Red Hat package) - update to 3.14.1-5.el8ui
python-pulp-rpm (Red Hat package) - update to 3.23.0-2.el8ui
python-pulp-rpm-client (Red Hat package) - update to 3.23.0-2.0.1.el8ui
python3x-pulpcore (Red Hat package) - addressed in versions 3.28.24-1.el8ap, 3.28.27-1.el8ap
python-pulpcore (Red Hat package) - addressed in versions 3.28.24-1.el9ap, 3.28.27-1.el9ap, 3.39.11-1.el8ui
python-pulpcore-client (Red Hat package) - update to 3.39.7-1.0.1.el8ui
python-async-timeout (Red Hat package) - update to 4.0.2-5.el8ui
python-uritemplate (Red Hat package) - update to 4.1.1-5.el8ui
python-pycares (Red Hat package) - update to 4.1.2-5.el8ui
python3-django-doc - update to 4.2.11-1
python3-django-bash-completion - update to 4.2.11-1
python3-django - update to 4.2.11-1
python3x-django (Red Hat package) - update to 4.2.11-1.el8ap
python-django - addressed in versions 4.2.11-1.fc39, 4.2.11-1.fc40, 4.2.11-1.fc41
python-redis (Red Hat package) - update to 4.3.4-4.el8ui
automation-controller (Red Hat package) - addressed in versions 4.5.5-2.el8ap, 4.5.5-2.el9ap, 4.5.7-1.el8ap, 4.5.7-1.el9ap
python-typing-extensions (Red Hat package) - update to 4.7.1-4.el8ui
rhui-tools (Red Hat package) - update to 4.8.0.1-1.el8ui
rhui-installer (Red Hat package) - update to 4.8.0.2-1.el8ui
python3x-galaxy-ng (Red Hat package) - update to 4.9.2-1.el8ap
automation-hub (Red Hat package) - addressed in versions 4.9.2-1.el8ap, 4.9.2-1.el9ap
python-galaxy-ng (Red Hat package) - update to 4.9.2-1.el9ap
python-jsonschema (Red Hat package) - update to 4.10.3-3.el8ui
python-protobuf (Red Hat package) - update to 4.21.6-4.el8ui
python3x-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el8ap
python-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el9ap
python-whitenoise (Red Hat package) - update to 6.0.0-4.el8ui
python-importlib-metadata (Red Hat package) - update to 6.0.1-4.el8ui
python-multidict (Red Hat package) - update to 6.0.4-4.el8ui
python-click (Red Hat package) - update to 8.1.3-4.el8ui
python3x-pillow (Red Hat package) - update to 10.3.0-1.el8ap
python-pillow (Red Hat package) - update to 10.3.0-1.el9ap
venv-openstack-horizon-x86_64 - addressed in versions 12.0.5~dev6-14.56.1, 14.1.1~dev11-4.53.1
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.56.1
python-gunicorn (Red Hat package) - addressed in versions 20.1.0-7.1.2.el8ui, 22.0.0-1.el9ap
python-packaging (Red Hat package) - update to 21.3-5.el8ui
python-attrs (Red Hat package) - update to 21.4.0-5.el8ui
python3x-gunicorn (Red Hat package) - update to 22.0.0-1.el8ap
python-aiofiles (Red Hat package) - update to 22.1.0-4.el8ui
python3x-black (Red Hat package) - update to 22.8.0-2.el8ap
python-black (Red Hat package) - update to 22.8.0-2.el9ap
python-django-filter (Red Hat package) - update to 23.2-3.el8ui
python3x-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el8ap
python-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el9ap
python-cryptography (Red Hat package) - addressed in versions 41.0.6-1.el8ui, 42.0.5-1.el9ap
python3x-cryptography (Red Hat package) - update to 42.0.5-1.el8ap
python-pytz (Red Hat package) - update to 2022.2.1-5.el8ui
python-uuid6 (Red Hat package) - update to 2023.5.2-4.el8ui
python-diff-match-patch (Red Hat package) - update to 20200713-6.el8ui
Red Hat Update Infrastructure (RHUI) - update to 4.8.0
Maximo Application Suite - Edge Data Collector - update to 8.11.5
Oracle Solaris - update to 11.4 SRU 71
Red Hat OpenStack - update to 17.1
dev-python/django - update to 5.2.1
python-django (Debian package) - update to 3:3.2.25-0+deb12u1

• https://www.djangoproject.com/weblog/2024/mar/04/security-releases/

• Denial of service in Django
• Ubuntu update for python-django
• Ubuntu update for python-django
• openEuler update for python-django
• Denial of service in Nautobot
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• SUSE update for python-Django
• SUSE update for python-Django
• Fedora 41 update for python-django
• Fedora 39 update for python-django
• Fedora 40 update for python-django
• Fedora EPEL 9 update for python-django3
• Inefficient regular expression complexity in IBM Maximo Application Suite - Edge Data Collector
• Fedora 38 update for python-django3
• Fedora 38 update for python-django3
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Anolis OS update for python-django
• Inefficient regular expression complexity in Red Hat OpenStack 17.1 packages
• Gentoo update for Django
• Debian update for python-django