CVE-2024-56374: Django: Potential denial-of-service vulnerability in IPv6 validation
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and isvalidipv6address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
Other sources
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and isvalidipv6address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.28-1~deb11u5Fixed in 3:4.2.19-1 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.18 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.0.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.1.5 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.1.5 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.0.11 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.2.18 - Compensating control
Apply mitigations for the IPv6 validation denial-of-service risk referenced by CVE-2024-56374 (e.g., constrain/limit request sizes or rates that reach Django’s IPv6 validation paths), since clean_ipv6_address / is_valid_ipv6_address and django.forms.GenericIPAddressField are affected.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56374?
CVE-2024-56374 is classified as a moderate severity vulnerability due to its potential for causing denial-of-service attacks.
How do I fix CVE-2024-56374?
To fix CVE-2024-56374, upgrade Django to version 5.1.5, 5.0.11, or 4.2.18, as appropriate.
Which Django versions are affected by CVE-2024-56374?
CVE-2024-56374 affects Django versions 4.2 before 4.2.18, 5.0 before 5.0.11, and 5.1 before 5.1.5.
What kind of attack can CVE-2024-56374 facilitate?
CVE-2024-56374 can potentially facilitate a denial-of-service attack through improper IPv6 validation.
Is there a workaround for CVE-2024-56374?
There is no official workaround for CVE-2024-56374, and the recommended action is to apply the necessary updates.