PYSEC-2024-102
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-45230
- Alias
- BIT-django-2024-45230, GHSA-5hgc-2vfp-mqvc
Description
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · django | introduced 5.1, fixed 5.1.1, introduced 5.0, fixed 5.0.9, introduced 4.2, fixed 4.2.16 |
Références
- https://docs.djangoproject.com/en/dev/releases/security/ WEB
- https://groups.google.com/forum/#%21forum/django-announce WEB
- https://www.djangoproject.com/weblog/2024/sep/03/security-releases/ ARTICLE
- https://github.com/advisories/GHSA-5hgc-2vfp-mqvc ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |