PT-2024-6153 · Django+5 · Django+5
Mprogrammer
·
Published
2024-07-31
·
Updated
2026-01-03
·
CVE-2024-41990
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.14
Django versions 5.0 through 5.0.7
Description
The issue is related to the
urlize() and urlizetrunc() template filters in Django, which can be subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is associated with a mismatch in the length parameters of the input data. A bounty of $2,162 was paid for the discovery of this issue.Recommendations
For Django versions 4.2 through 4.2.14, update to version 4.2.15 or later.
For Django versions 5.0 through 5.0.7, update to version 5.0.8 or later.
As a temporary workaround, consider restricting the use of the
urlize() and urlizetrunc() template filters until a patch is applied.Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Django
Linuxmint
Ubuntu