Denial-of-Service Vulnerability in Python Django Package - CVE-2024-45230
Summary
DEBIAN-CVE-2024-45230: An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. Affects python-django versions < 3:4.2.16-1. Fixed in 3:4.2.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Django is a high-level web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers features such as an ORM, routing, and templating. The framework is known for its security features, but it is not immune to vulnerabilities. This specific issue affects versions of Django prior to 5.1.1, 5.0.9, and 4.2.16, making it susceptible to denial-of-service attacks through its urlize() and urlizetrunc() template filters.
Vulnerability Detail
An issue was discovered in Django versions 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The vulnerability lies in the urlize() and urlizetrunc() template filters, which can be exploited through very large inputs containing specific character sequences. This can lead to a denial-of-service attack, potentially causing the application to become unresponsive or crash.
How To Fix
Minimum fixed version
3:4.2.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the size and content of inputs passed to the urlize() and urlizetrunc() filters. This can help mitigate the risk of denial-of-service attacks until the package is updated.
Conclusion
The CVE-2024-45230 vulnerability in the Django package poses a significant risk of denial-of-service attacks through specific template filters. It is crucial for users to update to the patched versions to mitigate this risk. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-45230 is a vulnerability in the Django web framework that allows for potential denial-of-service attacks through specific template filters.
The affected versions include Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to denial-of-service attacks, making the application unresponsive or crashing it.
If you cannot update immediately, implement input validation to limit the size and content of inputs to the vulnerable filters as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
