{"title":"Django 1.11.23 release notes","version":"dev","locale":"en","docname":"releases/1.11.23","url":"/en/dev/releases/1.11.23/","canonical":"https://djangodocs.dev/en/dev/releases/1.11.23/","summary":"Django 1.11.23 fixes security issues in 1.11.22. If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were…","html":"

Django 1.11.23 release notesLink to this heading#

\n

August 1, 2019

\n

Django 1.11.23 fixes security issues in 1.11.22.

\n
\n

CVE-2019-14232: Denial-of-service possibility in django.utils.text.TruncatorLink to this heading#

\n

If django.utils.text.Truncator’s chars() and words() methods\nwere passed the html=True argument, they were extremely slow to evaluate\ncertain inputs due to a catastrophic backtracking vulnerability in a regular\nexpression. The chars() and words() methods are used to implement the\ntruncatechars_html and truncatewords_html template\nfilters, which were thus vulnerable.

\n

The regular expressions used by Truncator have been simplified in order to\navoid potential backtracking issues. As a consequence, trailing punctuation may\nnow at times be included in the truncated output.

\n
\n
\n

CVE-2019-14233: Denial-of-service possibility in strip_tags()Link to this heading#

\n

Due to the behavior of the underlying HTMLParser,\ndjango.utils.html.strip_tags() would be extremely slow to evaluate\ncertain inputs containing large sequences of nested incomplete HTML entities.\nThe strip_tags() method is used to implement the corresponding\nstriptags template filter, which was thus also vulnerable.

\n

strip_tags() now avoids recursive calls to HTMLParser when progress\nremoving tags, but necessarily incomplete HTML entities, stops being made.

\n

Remember that absolutely NO guarantee is provided about the results of\nstrip_tags() being HTML safe. So NEVER mark safe the result of a\nstrip_tags() call without escaping it first, for example with\ndjango.utils.html.escape().

\n
\n
\n

CVE-2019-14234: SQL injection possibility in key and index lookups for JSONField/HStoreFieldLink to this heading#

\n

Key and index lookups for\ndjango.contrib.postgres.fields.JSONField and key lookups for HStoreField\nwere subject to SQL injection, using a suitably crafted dictionary, with\ndictionary expansion, as the **kwargs passed to QuerySet.filter().

\n
\n
\n

CVE-2019-14235: Potential memory exhaustion in django.utils.encoding.uri_to_iri()Link to this heading#

\n

If passed certain inputs, django.utils.encoding.uri_to_iri() could lead\nto significant memory usage due to excessive recursion when re-percent-encoding\ninvalid UTF-8 octet sequences.

\n

uri_to_iri() now avoids recursion when re-percent-encoding invalid UTF-8\noctet sequences.

\n
","rootId":"django-1-11-23-release-notes","toc":[{"title":"CVE-2019-14232: Denial-of-service possibility in django.utils.text.Truncator","anchor":"cve-2019-14232-denial-of-service-possibility-in-django-utils-text-truncator","children":[]},{"title":"CVE-2019-14233: Denial-of-service possibility in strip_tags()","anchor":"cve-2019-14233-denial-of-service-possibility-in-strip-tags","children":[]},{"title":"CVE-2019-14234: SQL injection possibility in key and index lookups for JSONField/HStoreField","anchor":"cve-2019-14234-sql-injection-possibility-in-key-and-index-lookups-for-jsonfield-hstorefield","children":[]},{"title":"CVE-2019-14235: Potential memory exhaustion in django.utils.encoding.uri_to_iri()","anchor":"cve-2019-14235-potential-memory-exhaustion-in-django-utils-encoding-uri-to-iri","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.11.24","title":"Django 1.11.24 release notes","url":"/en/dev/releases/1.11.24/"},"next":{"docname":"releases/1.11.22","title":"Django 1.11.22 release notes","url":"/en/dev/releases/1.11.22/"},"formats":{"html":"/en/dev/releases/1.11.23/","markdown":"/en/dev/releases/1.11.23.md","json":"/en/dev/releases/1.11.23.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.11.23.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.11.23/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","1.11"],"inLocales":["en"]}