CVE-2024-41989: Django CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.
Other sources
Description: If floatformat received a string representation of a number in scientific notation with a large exponent, it could lead to significant memory consumption.
To avoid this, decimals with more than 200 digits are now returned as is.
Affected versions =================
Django main development branch Django 5.1 (currently at release candidate status) Django 5.0 Django 4.2
— Red Hat
Django is vulnerable to a denial of service, caused by a memory exhaustion in django.utils.numberformat.floatformat() method. By sending a vspecially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.15 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.15-1 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 4.2.16-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.2.15
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41989?
CVE-2024-41989 has a high severity rating due to the potential for significant memory consumption.
How do I fix CVE-2024-41989?
To fix CVE-2024-41989, update Django to version 4.2.15 or 5.0.8 or later.
Which versions of Django are affected by CVE-2024-41989?
CVE-2024-41989 affects Django versions before 5.0.8 and 4.2 before 4.2.15.
What impact does CVE-2024-41989 have on applications?
CVE-2024-41989 can lead to application instability due to excessive memory consumption resulting from certain input.
Is there a workaround for CVE-2024-41989?
There is no officially recommended workaround for CVE-2024-41989; upgrading to a patched version is necessary.