GHSA-795c-9xpc-xw6g BIT-django-2024-41990 CVE-2024-41990 PYSEC-2024-68
Django vulnerable to a denial-of-service attack
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 1.26%
- Chance of exploitation in the next 30 days. Higher than 69.59% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-130 Improper Handling of Length Parameter Inconsistency
- Fix
5.0.8- Upgrade django to this version or later
Description
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| django | >= 5.0, < 5.0.8 |
5.0.8 |
| django | >= 4.2, < 4.2.15 |
4.2.15 |
| django | >= 5.0, < 5.0.8>= 4.2, < 4.2.15 |
4.2.155.0.8 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
django PyPI → 5.0.8
- pip
pip install --upgrade "django>=5.0.8"- poetry
poetry add "django>=5.0.8"- uv
uv add "django>=5.0.8"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-130: Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
How to prevent it
- Implementation: When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
- Implementation: Do not let the user control the size of the buffer.
- Implementation: Validate that the length of the user-supplied data is consistent with the buffer size.
References
Advisories
Write-ups
Packages
Other links
- github.com/django/django/commit/7b7b909579c8311c140c89b8a9431bf537febf93
- github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88
- docs.djangoproject.com/en/dev/releases/security
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-68.yaml
- groups.google.com/forum
- security.netapp.com/advisory/ntap-20240905-0007
- djangoproject.com/weblog/2024/aug/06/security-releases
- docs.djangoproject.com/en/dev/releases/security
- security.netapp.com/advisory/ntap-20240905-0007
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-q238-5cxm-5c9h Django GeoDjango vulnerable to denial of service through deeply nested geometry collections | Medium | Also affects django |
| GHSA-wvqv-fj8w-qmhm Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing | High | Also affects django |
| GHSA-8qcx-xf44-272x Django: DomainNameValidator permits newline characters that may enable HTTP header injection | Medium | Also affects django |
| GHSA-crhf-3pfg-w68w Django: GDALRaster may over-read heap memory when constructed from bytes | Medium | Also affects django |
| GHSA-3h9f-r86x-qvjx Django: cache middleware may expose private responses when unrelated request cookies are present | Medium | Also affects django |
| GHSA-8cjm-8mp7-r2xf Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling | Medium | Also affects django |
| GHSA-mm6v-q8q9-pgcf Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake | Low | Also affects django |
| GHSA-h7pc-vwp9-298g Django: signed cookies are vulnerable to salt namespace collisions | Medium | Also affects django |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor