---
title: "Django 1.11.23 release notes"
version: 5.2
locale: el
source: https://docs.djangoproject.com/el/5.2/releases/1.11.23/
canonical: https://djangodocs.dev/el/5.2/releases/1.11.23/
---
# Django 1.11.23 release notes

*August 1, 2019*

Django 1.11.23 fixes security issues in 1.11.22.

## CVE-2019-14232: Denial-of-service possibility in `django.utils.text.Truncator`

If `django.utils.text.Truncator`’s `chars()` and `words()` methods
were passed the `html=True` argument, they were extremely slow to evaluate
certain inputs due to a catastrophic backtracking vulnerability in a regular
expression. The `chars()` and `words()` methods are used to implement the
[`truncatechars_html`](/el/5.2/ref/templates/builtins/#std-templatefilter-truncatechars_html) and [`truncatewords_html`](/el/5.2/ref/templates/builtins/#std-templatefilter-truncatewords_html) template
filters, which were thus vulnerable.

The regular expressions used by `Truncator` have been simplified in order to
avoid potential backtracking issues. As a consequence, trailing punctuation may
now at times be included in the truncated output.

## CVE-2019-14233: Denial-of-service possibility in `strip_tags()`

Due to the behavior of the underlying `HTMLParser`,
[`django.utils.html.strip_tags()`](/el/5.2/ref/utils/#django.utils.html.strip_tags) would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The `strip_tags()` method is used to implement the corresponding
[`striptags`](/el/5.2/ref/templates/builtins/#std-templatefilter-striptags) template filter, which was thus also vulnerable.

`strip_tags()` now avoids recursive calls to `HTMLParser` when progress
removing tags, but necessarily incomplete HTML entities, stops being made.

Remember that absolutely NO guarantee is provided about the results of
`strip_tags()` being HTML safe. So NEVER mark safe the result of a
`strip_tags()` call without escaping it first, for example with
[`django.utils.html.escape()`](/el/5.2/ref/utils/#django.utils.html.escape).

## CVE-2019-14234: SQL injection possibility in key and index lookups for `JSONField`/`HStoreField`

[`Key and index lookups`](/el/5.2/topics/db/queries/#std-fieldlookup-jsonfield.key) for
`django.contrib.postgres.fields.JSONField` and [`key lookups`](/el/5.2/ref/contrib/postgres/fields/#std-fieldlookup-hstorefield.key) for [`HStoreField`](/el/5.2/ref/contrib/postgres/fields/#django.contrib.postgres.fields.HStoreField)
were subject to SQL injection, using a suitably crafted dictionary, with
dictionary expansion, as the `**kwargs` passed to `QuerySet.filter()`.

## CVE-2019-14235: Potential memory exhaustion in `django.utils.encoding.uri_to_iri()`

If passed certain inputs, [`django.utils.encoding.uri_to_iri()`](/el/5.2/ref/utils/#django.utils.encoding.uri_to_iri) could lead
to significant memory usage due to excessive recursion when re-percent-encoding
invalid UTF-8 octet sequences.

`uri_to_iri()` now avoids recursion when re-percent-encoding invalid UTF-8
octet sequences.