GoogleOSV:GHSA-QG2P-9JWR-MMQFDjango vulnerable to Denial of Service
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.
References
docs.djangoproject.com/en/dev/releases/security
github.com/django/django
github.com/django/django/commit/7285644640f085f41d60ab0c8ae4e9153f0485db
github.com/django/django/commit/79f368764295df109a37192f6182fb6f361d85b5
github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-56.yaml
groups.google.com/forum/#%21forum/django-announce
nvd.nist.gov/vuln/detail/CVE-2024-38875
www.djangoproject.com/weblog/2024/jul/09/security-releases
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High