REDHAT-BUG-2337996: Medium severity Django Django vulnerability
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and isvalidipv6address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2337996?
The severity of REDHAT-BUG-2337996 is classified as a potential denial-of-service vulnerability.
Which versions of Django are affected by REDHAT-BUG-2337996?
Django versions before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18 are affected by REDHAT-BUG-2337996.
How do I fix REDHAT-BUG-2337996?
To fix REDHAT-BUG-2337996, upgrade Django to version 5.1.5 or later, 5.0.11 or later, or 4.2.18 or later.
What type of attack can REDHAT-BUG-2337996 allow?
REDHAT-BUG-2337996 could allow a potential denial-of-service attack due to a lack of upper-bound limit enforcement in IPv6 validation.
Which functions are involved in the REDHAT-BUG-2337996 vulnerability?
The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are involved in the REDHAT-BUG-2337996 vulnerability.