high7.5
CVE-2024-45230
Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters
Impact
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | Django | >= 5.1, < 5.1.1 | 5.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Djangoproject | Django | from 4.2.0 before 4.2.16 from 5.0 before 5.0.9 Version 5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://www.djangoproject.com/weblog/2024/sep/03/security-releases/
- https://github.com/advisories/GHSA-5hgc-2vfp-mqvc
- https://nvd.nist.gov/vuln/detail/CVE-2024-45230
- https://docs.djangoproject.com/en/dev/releases/security
- https://www.djangoproject.com/weblog/2024/sep/03/security-releases
- https://github.com/django/django/commit/022ab0a75c76ab2ea31dfcc5f2cf5501e378d397
- https://github.com/django/django/commit/813de2672bd7361e9a453ab62cd6e52f96b6525b
- https://github.com/django/django/commit/d147a8ebbdf28c17cafbbe2884f0bc57e2bf82e2
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-102.yaml