CVE-2024-41991: Django CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Other sources
Description: urlize, urlizetrunc, and AdminURLFieldWidget were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Affected versions =================
Django main development branch Django 5.1 (currently at release candidate status) Django 5.0 Django 4.2
— Red Hat
Django is vulnerable to a denial of service, caused by a flaw in django.utils.html.urlize() and AdminURLFieldWidget method. By sending a vspecially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.15 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.15-1 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 4.2.16-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.2.15
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41991?
CVE-2024-41991 is classified as a moderate severity vulnerability due to its potential for denial-of-service attacks.
How do I fix CVE-2024-41991?
To mitigate CVE-2024-41991, upgrade Django to version 4.2.15 or 5.0.8 or later.
Which versions of Django are affected by CVE-2024-41991?
CVE-2024-41991 affects Django versions 5.0 prior to 5.0.8 and 4.2 prior to 4.2.15.
What components of Django are impacted by CVE-2024-41991?
CVE-2024-41991 impacts the urlize and urlizetrunc template filters and the AdminURLFieldWidget widget.
Can CVE-2024-41991 cause service interruptions?
Yes, CVE-2024-41991 can lead to service interruptions via denial-of-service attacks when vulnerable inputs are processed.