CVE-2024-28865: 
Python vulnerability analysis and mitigation

django-wiki, a wiki system for Django, was found to contain a vulnerability (CVE-2024-28865) affecting versions prior to 0.10.1. The vulnerability allows maliciously crafted article content to cause severe CPU usage through a regular expression loop. The issue was discovered and disclosed on March 16, 2024 (GitHub Advisory).

The vulnerability is classified as a Regular Expression Denial of Service (ReDoS) issue with a CVSS v3.1 base score of 7.5 (High). The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U), with no impact on confidentiality (C:N) or integrity (I:N), but high impact on availability (A:H) (GitHub Advisory).

When exploited, this vulnerability can cause severe server CPU utilization through regular expression backtracking, potentially leading to a denial of service condition. The attack can be executed remotely without requiring any special privileges or user interaction (GitHub Advisory).

The vulnerability can be exploited by submitting maliciously crafted article content to a django-wiki installation. The attack requires no special privileges or user interaction, making it relatively straightforward to exploit (GitHub Advisory).

The vulnerability has been patched in version 0.10.1. Users are advised to upgrade to this version or later. As a temporary workaround, administrators can close off access to create and edit articles by anonymous users (GitHub Advisory).