Django Regular Expression Denial-of-Service Vulnerability - CVE-2024-27351
Summary
CVE-2024-27351: In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expressi... Affects python-django across 4 version ranges.
< 2:2.2.28-1~deb11u7
< 3c9a2771cc80821e041b16eb36c1c37af5349d4a
< 3394fc6132436eca89e997083bae9985fb7e761e
< 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521
Fixed in 2:2.2.28-1~deb11u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, authentication, and templating. The framework is widely used for its scalability and security features. However, certain versions of Django are vulnerable to a denial-of-service attack due to improper handling of regular expressions in the truncation methods, which can be exploited through crafted strings.
Vulnerability Detail
CVE-2024-27351 affects Django versions 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3. The vulnerability arises from the django.utils.text.Truncator.words() method (when html=True) and the truncatewords_html template filter, which are susceptible to a regular expression denial-of-service (ReDoS) attack. This vulnerability is particularly concerning as it can lead to application performance degradation or complete service unavailability when an attacker sends specially crafted input strings. This issue is a result of an incomplete fix for previous vulnerabilities, CVE-2019-14232 and CVE-2023-43665.
How To Fix
Minimum fixed version
2:2.2.28-1~deb11u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider sanitizing input strings before passing them to the truncation methods. This can be done by implementing a validation step that checks for overly complex or malicious patterns in user input, thereby mitigating the risk of a ReDoS attack.
Conclusion
CVE-2024-27351 is a significant vulnerability affecting multiple versions of Django, which can lead to denial-of-service attacks. It is crucial for developers to upgrade to the latest versions to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until an upgrade can be performed.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-27351 is a vulnerability in Django that allows for a regular expression denial-of-service attack through certain truncation methods.
Django versions 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to performance degradation or complete service unavailability if exploited by an attacker.
If you cannot upgrade immediately, implement input validation to sanitize user inputs before processing them with the truncation methods.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
