Critical Memory Consumption Vulnerability in Python-Django Package
Summary
UBUNTU-CVE-2024-41989: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers a range of features including an ORM, URL routing, and templating. However, certain versions of Python-Django are vulnerable to a memory consumption issue that can be exploited under specific conditions.
Vulnerability Detail
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. This vulnerability can lead to Denial of Service (DoS) by exhausting server memory, potentially crashing the application or making it unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the floatformat template filter with large exponent scientific notation strings until the package is updated. Consider implementing input validation to restrict the format of numbers being processed.
Conclusion
The memory consumption vulnerability in Python-Django poses a significant risk to applications using affected versions. It is crucial to update to the patched versions to mitigate the risk of Denial of Service attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for python-django →
FAQ
The vulnerability affects Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15.
The vulnerability can lead to significant memory consumption, resulting in Denial of Service (DoS) attacks that can crash or slow down the application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, there are patched versions available for the affected Python-Django packages. Ensure to update to the latest version.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
