CVE-2023-41164

CVE	CVE-2023-41164
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-11-03 05:15:00 UTC
Updated	2023-11-13 15:32:00 UTC
Description	In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

Problem Types: CWE-1284

Type	Vendor	Product	Version	Update	Edition	Language
Application	Djangoproject	Django	All	All	All	All
Operating System	Fedoraproject	Fedora	39	All	All	All

Reference	Source	Link	Tags
Redirecting to Google Groups		groups.google.com
[SECURITY] Fedora 39 Update: python-django-4.2.6-1.fc39 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Redirecting to Google Groups	MISC	groups.google.com
[SECURITY] Fedora 39 Update: python-django-4.2.6-1.fc39 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
Archive of security issues \| Django documentation \| Django	MISC	docs.djangoproject.com
Django security releases issued: 4.2.5, 4.1.11, and 3.2.21 \| Weblog \| Django	CONFIRM	www.djangoproject.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

199760 Ubuntu Security Notification for Django Vulnerability (USN-6378-1)
199805 Ubuntu Security Notification for Django Vulnerabilities (USN-6414-2)
284628 Fedora Security Update for python (FEDORA-2023-cc023fabb7)
284653 Fedora Security Update for python (FEDORA-2023-9d36d373f1)
285198 Fedora Security Update for python (FEDORA-2023-a67af7d8f4)
296105 Oracle Solaris 11.4 Support Repository Update (SRU) 63.157.1 Missing (CPUOCT2023)
506174 Alpine Linux Security Update for py3-django
6000140 Debian Security Update for python-django (DLA 3558-1)
995837 Python (Pip) Security Update for django (GHSA-7h4p-27mh-hmrw)