Denial-of-Service Vulnerability in Python Django Package
Summary
DEBIAN-CVE-2024-41991: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions < 3:4.2.15-1. Fixed in 3:4.2.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Django is a high-level web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an ORM, authentication, and an admin interface. However, certain versions of Django are vulnerable to a denial-of-service attack due to specific template filters and widgets that mishandle large Unicode inputs.
Vulnerability Detail
An issue was discovered in Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. The vulnerability lies in the urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget, which can be exploited by providing inputs with a very large number of Unicode characters. This can lead to a denial-of-service condition, potentially disrupting the availability of the application.
How To Fix
Minimum fixed version
3:4.2.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can sanitize inputs to the urlize and urlizetrunc filters to limit the number of Unicode characters processed. This can help mitigate the risk of denial-of-service attacks until the package is updated.
Conclusion
The vulnerability in the Python Django package poses a significant risk of denial-of-service attacks through specific template filters and widgets. It is crucial to update to the patched version to ensure the security and availability of applications using Django. Implementing input sanitization can serve as a temporary workaround.
See every vulnerability recorded for python-django →
FAQ
Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15 are affected by this vulnerability.
A denial-of-service attack aims to make a service unavailable to its intended users, often by overwhelming it with excessive requests or inputs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement input sanitization to limit the number of Unicode characters processed by the vulnerable filters.
More details can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41991.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
