Denial-of-Service Vulnerability in Python-Django: CVE-2024-41991
Summary
UBUNTU-CVE-2024-41991: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and is known for its robustness, scalability, and security features. However, certain versions of Django are vulnerable to a denial-of-service attack due to improper handling of specific inputs, which can lead to significant service disruptions.
Vulnerability Detail
An issue was discovered in Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. The vulnerability affects the urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget. These components are susceptible to a denial-of-service attack when they process inputs containing a very large number of Unicode characters. This can lead to excessive resource consumption, potentially crashing the application or making it unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to restrict the number of Unicode characters that can be processed by the vulnerable filters. This can help mitigate the risk of denial-of-service attacks.
Conclusion
CVE-2024-41991 represents a significant denial-of-service vulnerability in Python-Django that can lead to application downtime. It is crucial to update to the latest patched version or implement workarounds to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-41991 is a vulnerability in certain versions of Python-Django that allows for potential denial-of-service attacks through specific inputs.
The vulnerability affects Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15, as well as various versions in Ubuntu distributions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2024-41991 is 7.5, indicating a high severity level.
If you cannot update the package, implement input validation to limit the number of Unicode characters processed by the vulnerable filters as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
