REDHAT-BUG-2484377: High severity Django daphne vulnerability
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484377?
The severity of REDHAT-BUG-2484377 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2484377?
To fix REDHAT-BUG-2484377, upgrade to daphne version 4.2.2 or later, ensuring proper configuration of maxFramePayloadSize and maxMessagePayloadSize.
What are the potential impacts of REDHAT-BUG-2484377?
The potential impacts of REDHAT-BUG-2484377 include excessive memory consumption caused by unauthenticated remote attackers sending arbitrarily large WebSocket messages.
Which software is affected by REDHAT-BUG-2484377?
The software affected by REDHAT-BUG-2484377 is Django daphne, specifically versions prior to 4.2.2.
Is authentication required to exploit REDHAT-BUG-2484377?
No, exploitation of REDHAT-BUG-2484377 does not require authentication, making it particularly concerning.