Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN289

_____________________________________________________________________

DATE                : 09/05/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Django versions prior
                         to 5.2.1, 5.1.9, 4.2.21.

=====================================================================
https://www.djangoproject.com/weblog/2025/may/07/security-releases/
_____________________________________________________________________

Django security releases issued: 5.2.1, 5.1.9 and 4.2.21
Posted by Natalia Bidart on 7 mai 2025

In accordance with our security release policy, the Django team
is issuing releases for Django 5.2.1, Django 5.1.9 and Django
4.2.21. These releases address the security issues detailed below.
We encourage all users of Django to upgrade as soon as possible.


CVE-2025-32873: Denial-of-service possibility in strip_tags()

django.utils.html.strip_tags() would be slow to evaluate certain inputs
containing large sequences of incomplete HTML tags. This function is
used to implement the striptags template filter, which was thus also
vulnerable. django.utils.html.strip_tags() now raises a
SuspiciousOperation exception if it encounters an unusually large
number of unclosed opening tags.


Thanks to Elias Myllymäki for the report.

This issue has severity "moderate" according to the Django security
policy.


Affected supported versions

    Django main
    Django 5.2
    Django 5.1
    Django 4.2


Resolution

Patches to resolve the issue have been applied to Django's main,
5.2, 5.1, and 4.2 branches. The patches may be obtained from the
following changesets.


CVE-2025-32873: Denial-of-service possibility in strip_tags()

    On the main branch
    On the 5.2 branch
    On the 5.1 branch
    On the 4.2 branch

The following releases have been issued

    Django 5.2.1 (download Django 5.2.1 | 5.2.1 checksums)
    Django 5.1.9 (download Django 5.1.9 | 5.1.9 checksums)
    Django 4.2.21 (download Django 4.2.21 | 4.2.21 checksums)

The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E
General notes regarding security reporting

As always, we ask that potential security issues be reported via
private email to security@djangoproject.com, and not via Django's
Trac instance, nor via the Django Forum. Please see our security
policies for further information.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================