PT-2024-1785 · Django+6 · Django+6
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 3.2 before 3.2.24
Django versions 4.2 before 4.2.10
Django versions 5.0 before 5.0.2
Description
The issue is related to a potential denial-of-service attack when the intcomma template filter is used with very long strings. This could allow a remote attacker to cause a denial of service. The vulnerability is associated with uncontrolled resource consumption.
Recommendations
For Django versions 3.2 before 3.2.24, update to version 3.2.24 or later to resolve the issue.
For Django versions 4.2 before 4.2.10, update to version 4.2.10 or later to resolve the issue.
For Django versions 5.0 before 5.0.2, update to version 5.0.2 or later to resolve the issue.
As a temporary workaround, consider avoiding the use of the intcomma template filter with very long strings until a patch is available.
Exploit
Fix
Allocation of Resources Without Limits
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Django
Linuxmint
Red Os
Ubuntu