Denial-of-Service Vulnerability in Django IPv6 Validation
Summary
CVE-2024-56374: An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Affects python-django versions < 2:2.2.28-1~deb11u5. Fixed in 2:2.2.28-1~deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, form handling, and authentication. The framework is widely used for its scalability and security features. However, certain versions of Django are vulnerable to a denial-of-service attack due to improper handling of IPv6 address validation, affecting its reliability in production environments.
Vulnerability Detail
An issue was discovered in Django versions 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. The vulnerability arises from a lack of upper-bound limit enforcement in strings passed during IPv6 validation. This oversight can lead to a potential denial-of-service attack, as the undocumented functions 'clean_ipv6_address' and 'is_valid_ipv6_address', along with the 'django.forms.GenericIPAddressField' form field, are susceptible. The 'django.db.models.GenericIPAddressField' model field is not affected by this vulnerability.
How To Fix
Minimum fixed version
2:2.2.28-1~deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation on your own to limit the length of IPv6 addresses before they are processed by Django. For example, you can use the following code snippet in your form validation: 'if len(ipv6_address) > MAX_LENGTH: raise ValidationError('IPv6 address too long')'.
Conclusion
The identified vulnerability in Django's IPv6 validation poses a significant risk of denial-of-service attacks. It is crucial for developers using affected versions to update their installations promptly and consider implementing additional input validation as a temporary measure. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python-django →
FAQ
Django versions 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18 are affected.
The vulnerability can lead to a denial-of-service attack, potentially making the application unresponsive.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, patches are available in the newer versions of Django. Update to the latest version to mitigate the risk.
Implement input validation to limit the length of IPv6 addresses as a temporary workaround until you can update.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
