Memory Consumption Vulnerability in Python Django Package
Summary
DEBIAN-CVE-2024-41989: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions < 3:4.2.15-1. Fixed in 3:4.2.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Django is a high-level web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features for developers, including an ORM, routing, and templating. However, certain versions of Django are vulnerable to a memory consumption issue when using the floatformat template filter with large exponent scientific notation.
Vulnerability Detail
An issue was discovered in Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. The vulnerability arises when the floatformat template filter processes a string representation of a number in scientific notation with a large exponent, leading to significant memory consumption. This can result in denial of service as the application may become unresponsive due to excessive memory usage.
How To Fix
Minimum fixed version
3:4.2.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the floatformat template filter with large exponent scientific notation strings until the package is updated.
Conclusion
The memory consumption vulnerability in the Python Django package poses a significant risk to applications using affected versions. It is crucial to update to the patched version to mitigate this risk. Users can also utilize Vulert to monitor and check for vulnerabilities in their applications easily.
See every vulnerability recorded for python-django →
FAQ
Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15 are affected.
The vulnerability can lead to significant memory consumption, potentially causing denial of service as the application may become unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patched version of Django is available. Update to version 3:4.2.15-1 or later.
As a temporary measure, avoid using the floatformat template filter with large exponent scientific notation strings until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
