CVE-2024-38875: Django CVE-2024-38875, CVE-2024-39329, CVE-2024-39330, and CVE-2024-39614
An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.
Other sources
Django is vulnerable to a denial of service, caused by improper input validation by the urlize() and urlizetrunc() functions. By sending a specially crafted request using large number of brackets, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
django.utils.html.urlize() was subject to a potential denial-of-service attack via certain inputs with a very large number of brackets.
Affected versions =================
Django main development branch Django 5.1 Django 5.0 Django 4.2
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.0.7 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.14 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.14-1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.18-2 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 4.2.16-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.2.14 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.0.7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38875?
CVE-2024-38875 has a severity that indicates a potential denial of service risk in affected versions of Django.
How do I fix CVE-2024-38875?
To fix CVE-2024-38875, upgrade to Django version 4.2.14 or 5.0.7 or later.
Which versions of Django are affected by CVE-2024-38875?
CVE-2024-38875 affects Django versions prior to 4.2.14 and 5.0 before 5.0.7.
What types of attacks are enabled by CVE-2024-38875?
CVE-2024-38875 may enable denial of service attacks through improper handling of inputs with numerous brackets.
Is there a specific recommendation for users of Django related to CVE-2024-38875?
Users of Django are advised to update their installations to the patched versions to mitigate the risks posed by CVE-2024-38875.