CVE-2023-36053
Fixed in a distro release EPSS 3%CVSS 7.5
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Products: debian_linux, fedoraproject fedora, djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 3.2.20 |
| PyPI | django | 4.1.10 |
| PyPI | django | 4.2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:10 | python-django | 1:1.11.29-1+deb10u9 |
| Debian:11 | python-django | 2:2.2.28-1~deb11u2 |
| Debian:12 | python-django | 3:3.2.19-1+deb12u1 |
| Debian:13 | python-django | 3:3.2.20-1 |
| Debian:14 | python-django | 3:3.2.20-1 |
| Red Hat:ansible_automation_platform:2.4 | automation-controller | 0:4.4.2-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller | 0:4.4.2-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-venv-tower | 0:4.4.2-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-venv-tower | 0:4.4.2-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | automation-eda-controller | 0:1.0.1-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | automation-eda-controller | 0:1.0.1-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-eda-controller-server | 0:1.0.1-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | automation-eda-controller-server | 0:1.0.1-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-eda-controller-ui | 0:1.0.1-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-eda-controller-ui | 0:1.0.1-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python-cryptography | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python-cryptography-debugsource | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python-django | 0:3.2.20-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python3-cryptography | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python3-cryptography-debuginfo | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python3-django | 0:3.2.20-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python39-cryptography | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python39-cryptography-debuginfo | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python39-django | 0:3.2.20-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python39-requests | 0:2.31.0-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python3x-cryptography | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python3x-cryptography-debugsource | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python3x-django | 0:3.2.20-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python3x-requests | 0:2.31.0-1.el8ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python-cryptography | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python-cryptography-debugsource | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python3-cryptography | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python3-cryptography-debuginfo | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python39-cryptography | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python39-cryptography-debuginfo | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python3x-cryptography | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python3x-cryptography-debugsource | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python-cryptography | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python-cryptography-debugsource | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python3-cryptography | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python3-cryptography-debuginfo | 0:38.0.4-2.el9ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python39-cryptography | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python39-cryptography-debuginfo | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python3x-cryptography | 0:38.0.4-2.el8ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python3x-cryptography-debugsource | 0:38.0.4-2.el8ap |
| Red Hat:openstack:17.1 | python-django | 0:2.2.24-5.el9ost |
| Red Hat:openstack:17.1 | python3-django | 0:2.2.24-5.el9ost |
| Red Hat:rhui:4 | python-aiohttp | 0:3.9.2-1.el8ui |
| Red Hat:rhui:4 | python-aiohttp-debugsource | 0:3.9.2-1.el8ui |
| Red Hat:rhui:4 | python-cryptography | 0:41.0.6-1.el8ui |
| Red Hat:rhui:4 | python-cryptography-debugsource | 0:41.0.6-1.el8ui |
| Red Hat:rhui:4 | python-django | 0:4.2.11-1.el8ui |
| Red Hat:rhui:4 | python-ecdsa | 0:0.18.0-4.el8ui |
| Red Hat:rhui:4 | python-jinja2 | 0:3.1.3-1.el8ui |
| Red Hat:rhui:4 | python3.11-aiohttp | 0:3.9.2-1.el8ui |
| Red Hat:rhui:4 | python3.11-aiohttp-debuginfo | 0:3.9.2-1.el8ui |
| Red Hat:rhui:4 | python3.11-cryptography | 0:41.0.6-1.el8ui |
| Red Hat:rhui:4 | python3.11-cryptography-debuginfo | 0:41.0.6-1.el8ui |
| Red Hat:rhui:4 | python3.11-django | 0:4.2.11-1.el8ui |
| Red Hat:rhui:4 | python3.11-ecdsa | 0:0.18.0-4.el8ui |
| Red Hat:rhui:4 | python3.11-jinja2 | 0:3.1.3-1.el8ui |
| Red Hat:satellite:6.13 | foreman | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-cli | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-debug | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-dynflow-sidekiq | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-ec2 | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-journald | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-libvirt | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-openstack | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-ovirt | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-postgresql | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-service | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-telemetry | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | foreman-vmware | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite:6.13 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat:satellite:6.13 | python-django | 0:3.2.21-1.el8pc |
| Red Hat:satellite:6.13 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat:satellite:6.13 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat:satellite:6.13 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat:satellite:6.13 | rubygem-git | 0:1.18.0-1.el8sat |
| Red Hat:satellite:6.13 | yggdrasil-worker-forwarder | 0:0.0.3-1.el8sat |
| Red Hat:satellite:6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-cli | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-debug | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-dynflow-sidekiq | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-ec2 | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-journald | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-libvirt | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-openstack | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-ovirt | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-postgresql | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-redis | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-service | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-telemetry | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | foreman-vmware | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite:6.14 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat:satellite:6.14 | puppetserver | 0:7.11.0-1.el8sat |
| Red Hat:satellite:6.14 | python-django | 0:3.2.21-1.el8pc |
| Red Hat:satellite:6.14 | python-future | 0:0.18.3-1.el8pc |
| Red Hat:satellite:6.14 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat:satellite:6.14 | python-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat:satellite:6.14 | python-requests | 0:2.31.0-1.el8pc |
| Red Hat:satellite:6.14 | python-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat:satellite:6.14 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat:satellite:6.14 | python39-future | 0:0.18.3-1.el8pc |
| Red Hat:satellite:6.14 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat:satellite:6.14 | python39-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat:satellite:6.14 | python39-requests | 0:2.31.0-1.el8pc |
| Red Hat:satellite:6.14 | python39-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat:satellite:6.14 | rubygem-actionpack | 0:6.1.7.3-1.el8sat |
| Red Hat:satellite:6.14 | rubygem-activerecord | 0:6.1.7.3-1.el8sat |
| Red Hat:satellite:6.14 | rubygem-activesupport | 0:6.1.7.3-1.el8sat |
| Red Hat:satellite:6.14 | rubygem-git | 0:1.18.0-1.el8sat |
| Red Hat:satellite:6.14 | rubygem-globalid | 0:1.1.0-1.el8sat |
| Red Hat:satellite:6.14 | rubygem-kubeclient | 0:4.10.1-1.el8sat |
| Red Hat:satellite:6.14 | rubygem-rack | 0:2.2.7-1.el8sat |
| Red Hat:satellite:6.14 | yggdrasil-worker-forwarder | 0:0.0.3-1.el8sat |
| Red Hat:satellite_capsule:6.13 | foreman | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite_capsule:6.13 | foreman-debug | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite_capsule:6.13 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat:satellite_capsule:6.13 | python-django | 0:3.2.21-1.el8pc |
| Red Hat:satellite_capsule:6.13 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat:satellite_capsule:6.13 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat:satellite_capsule:6.13 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat:satellite_capsule:6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite_capsule:6.14 | foreman-debug | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite_capsule:6.14 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat:satellite_capsule:6.14 | puppetserver | 0:7.11.0-1.el8sat |
| Red Hat:satellite_capsule:6.14 | python-django | 0:3.2.21-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python-future | 0:0.18.3-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python-requests | 0:2.31.0-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python39-future | 0:0.18.3-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python39-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python39-requests | 0:2.31.0-1.el8pc |
| Red Hat:satellite_capsule:6.14 | python39-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat:satellite_capsule:6.14 | rubygem-rack | 0:2.2.7-1.el8sat |
| Red Hat:satellite_utils:6.13 | foreman | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite_utils:6.13 | foreman-cli | 0:3.5.1.23-1.el8sat |
| Red Hat:satellite_utils:6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat:satellite_utils:6.14 | foreman-cli | 0:3.7.0.9-1.el8sat |
| SUSE:HPE Helion OpenStack 8 | python-Django | 1.11.29-3.48.1 |
| SUSE:OpenStack Cloud 8 | python-Django | 1.11.29-3.48.1 |
| SUSE:OpenStack Cloud 9 | python-Django1 | 1.11.29-3.47.1 |
| SUSE:OpenStack Cloud Crowbar 8 | python-Django | 1.11.29-3.48.1 |
| SUSE:OpenStack Cloud Crowbar 9 | python-Django1 | 1.11.29-3.47.1 |
| SUSE:Package Hub 15 SP4 | python-Django | 2.2.28-bp154.2.12.1 |
| SUSE:Package Hub 15 SP4 | python-Django1 | 1.11.29-bp154.2.6.1 |
| SUSE:Package Hub 15 SP5 | python-Django | 2.2.28-bp155.7.3.1 |
| SUSE:Package Hub 15 SP5 | python-Django1 | 1.11.29-bp155.4.3.1 |
| Ubuntu:20.04:LTS | python-django | 2:2.2.12-1ubuntu0.18 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.7 |
| Ubuntu:Pro:14.04:LTS | python-django | no fix |
| Ubuntu:Pro:16.04:LTS | python-django | no fix |
| Ubuntu:Pro:18.04:LTS | python-django | 1:1.11.11-1ubuntu1.21+esm1 |
| openSUSE:Leap 15.4 | python-Django | 2.2.28-bp154.2.12.1 |
| openSUSE:Leap 15.4 | python-Django1 | 1.11.29-bp154.2.6.1 |
| openSUSE:Leap 15.5 | python-Django | 2.0.7-150000.1.11.1 |
| openSUSE:Leap 15.5 | python-Django | 2.2.28-bp155.7.3.1 |
| openSUSE:Leap 15.5 | python-Django1 | 1.11.29-bp155.4.3.1 |
| openSUSE:Tumbleweed | python-Django | 4.2.3-1.1 |
| openSUSE:Tumbleweed | python-Django | 5.2.16-1.1 |
| openSUSE:Tumbleweed | python-Django4 | 4.2.14-1.1 |
| openSUSE:Tumbleweed | python-Django4 | 4.2.30-4.1 |
| openSUSE:Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE:Tumbleweed | python-Django6 | 6.0-1.1 |