Denial of Service Vulnerability in Python-Django: CVE-2024-38875
Summary
UBUNTU-CVE-2024-38875: An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including URL routing, ORM, and templating. However, certain versions of Django are susceptible to a denial of service vulnerability due to improper handling of inputs in the urlize and urlizetrunc functions, which can be exploited with specially crafted inputs.
Vulnerability Detail
An issue was discovered in Django versions 4.2 before 4.2.14 and 5.0 before 5.0.7. The vulnerability arises from the urlize and urlizetrunc functions being subject to a potential denial of service attack via inputs containing a very large number of brackets. This could lead to excessive resource consumption, causing the application to become unresponsive or crash. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the urlize and urlizetrunc functions with untrusted input or limit the input size to prevent potential denial of service attacks.
Conclusion
The CVE-2024-38875 vulnerability in Python-Django poses a significant risk of denial of service attacks due to improper input handling. It is crucial for users to update their Django installations to the latest patched versions to mitigate this risk. Additionally, implementing input validation can serve as a temporary measure until updates can be applied.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-38875 is a vulnerability in Django that allows for a potential denial of service attack through the improper handling of inputs in certain functions.
The vulnerability affects Django versions 4.2 before 4.2.14 and 5.0 before 5.0.7.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing input validation to limit the size and content of inputs passed to urlize and urlizetrunc functions.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
