CVE-2024-41990: Django CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
Other sources
Description: urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
Affected versions =================
Django main development branch Django 5.1 (currently at release candidate status) Django 5.0 Django 4.2
— Red Hat
Django is vulnerable to a denial of service, caused by a flaw in django.utils.html.urlize() method. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.15 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.15-1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.18-2 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 4.2.16-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.2.15
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41990?
CVE-2024-41990 has a severity level that indicates it is susceptible to denial-of-service attacks due to processing large inputs.
How do I fix CVE-2024-41990?
To fix CVE-2024-41990, upgrade Django to version 5.0.8 or 4.2.15 or later.
Which versions of Django are affected by CVE-2024-41990?
Django versions prior to 5.0.8 and 4.2.15 are affected by CVE-2024-41990.
What are the consequences of not addressing CVE-2024-41990?
Failing to address CVE-2024-41990 could lead to denial-of-service vulnerabilities which may disrupt application availability.
Is CVE-2024-41990 related to specific template filters in Django?
Yes, CVE-2024-41990 specifically affects the urlize() and urlizetrunc() template filters in Django.