CVE-2024-41991
Fixed in a distro release EPSS <1%CVSS 7.5
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 5.0.8 |
| PyPI | django | 4.2.15 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:11 | python-django | 2:2.2.28-1~deb11u11 |
| Debian:12 | python-django | 3:3.2.25-0+deb12u1 |
| Debian:13 | python-django | 3:4.2.15-1 |
| Debian:14 | python-django | 3:4.2.15-1 |
| Red Hat:ansible_automation_platform:2.4 | automation-controller | 0:4.5.10-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller | 0:4.5.10-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-cli | 0:4.5.10-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-cli | 0:4.5.10-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-server | 0:4.5.10-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-server | 0:4.5.10-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-ui | 0:4.5.10-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-ui | 0:4.5.10-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-venv-tower | 0:4.5.10-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | automation-controller-venv-tower | 0:4.5.10-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python-django | 0:4.2.15-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python-grpcio | 0:1.58.3-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python-grpcio-debugsource | 0:1.58.3-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python-zipp | 0:3.19.2-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python3-django | 0:4.2.15-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python3-grpcio | 0:1.58.3-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python3-grpcio-debuginfo | 0:1.58.3-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python3-zipp | 0:3.19.2-1.el9ap |
| Red Hat:ansible_automation_platform:2.4 | python39-django | 0:4.2.15-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python39-grpcio | 0:1.58.3-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python39-grpcio-debuginfo | 0:1.58.3-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python39-zipp | 0:3.19.2-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python3x-django | 0:4.2.15-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python3x-grpcio | 0:1.58.3-1.el8ap |
| Red Hat:ansible_automation_platform:2.4 | python3x-grpcio-debugsource | 0:1.58.3-1.el8ap |
| Red Hat:ansible_automation_platform_developer:2.4 | automation-controller | 0:4.5.10-1.el8ap |
| Red Hat:ansible_automation_platform_developer:2.4 | automation-controller | 0:4.5.10-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.4 | automation-controller-cli | 0:4.5.10-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.4 | automation-controller-cli | 0:4.5.10-1.el8ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python-zipp | 0:3.19.2-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python3-zipp | 0:3.19.2-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.4 | python39-zipp | 0:3.19.2-1.el8ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python-zipp | 0:3.19.2-1.el9ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python3-zipp | 0:3.19.2-1.el9ap |
| Red Hat:ansible_automation_platform_inside:2.4 | python39-zipp | 0:3.19.2-1.el8ap |
| Red Hat:rhui:4 | python-aiohttp | 0:3.9.4-1.el8ui |
| Red Hat:rhui:4 | python-aiohttp-debugsource | 0:3.9.4-1.el8ui |
| Red Hat:rhui:4 | python-cryptography | 0:42.0.8-1.el8ui |
| Red Hat:rhui:4 | python-cryptography-debugsource | 0:42.0.8-1.el8ui |
| Red Hat:rhui:4 | python-django | 0:4.2.15-1.el8ui |
| Red Hat:rhui:4 | python-grpcio | 0:1.65.4-1.el8ui |
| Red Hat:rhui:4 | python-grpcio-debugsource | 0:1.65.4-1.el8ui |
| Red Hat:rhui:4 | python-gunicorn | 0:22.0.0-1.0.1.el8ui |
| Red Hat:rhui:4 | python-jinja2 | 0:3.1.4-1.el8ui |
| Red Hat:rhui:4 | python-requests | 0:2.32.3-2.el8ui |
| Red Hat:rhui:4 | python-sqlparse | 0:0.5.0-1.el8ui |
| Red Hat:rhui:4 | python3.11-aiohttp | 0:3.9.4-1.el8ui |
| Red Hat:rhui:4 | python3.11-aiohttp-debuginfo | 0:3.9.4-1.el8ui |
| Red Hat:rhui:4 | python3.11-cryptography | 0:42.0.8-1.el8ui |
| Red Hat:rhui:4 | python3.11-cryptography-debuginfo | 0:42.0.8-1.el8ui |
| Red Hat:rhui:4 | python3.11-django | 0:4.2.15-1.el8ui |
| Red Hat:rhui:4 | python3.11-grpcio | 0:1.65.4-1.el8ui |
| Red Hat:rhui:4 | python3.11-grpcio-debuginfo | 0:1.65.4-1.el8ui |
| Red Hat:rhui:4 | python3.11-gunicorn | 0:22.0.0-1.0.1.el8ui |
| Red Hat:rhui:4 | python3.11-jinja2 | 0:3.1.4-1.el8ui |
| Red Hat:rhui:4 | python3.11-requests | 0:2.32.3-2.el8ui |
| Red Hat:rhui:4 | python3.11-sqlparse | 0:0.5.0-1.el8ui |
| Red Hat:satellite:6.15 | python-cryptography | 0:42.0.8-1.el8pc |
| Red Hat:satellite:6.15 | python-cryptography-debugsource | 0:42.0.8-1.el8pc |
| Red Hat:satellite:6.15 | python-django | 0:4.2.15-1.el8pc |
| Red Hat:satellite:6.15 | python-gunicorn | 0:22.0.0-1.el8pc |
| Red Hat:satellite:6.15 | python3.11-cryptography | 0:42.0.8-1.el8pc |
| Red Hat:satellite:6.15 | python3.11-cryptography-debuginfo | 0:42.0.8-1.el8pc |
| Red Hat:satellite:6.15 | python3.11-django | 0:4.2.15-1.el8pc |
| Red Hat:satellite:6.15 | python3.11-gunicorn | 0:22.0.0-1.el8pc |
| Red Hat:satellite:6.15 | rubygem-foreman_theme_satellite | 0:13.3.0-0.1.el8sat |
| Red Hat:satellite:6.15 | yggdrasil-worker-forwarder | 0:0.0.3-2.el8sat |
| Red Hat:satellite_capsule:6.15 | python-cryptography | 0:42.0.8-1.el8pc |
| Red Hat:satellite_capsule:6.15 | python-cryptography-debugsource | 0:42.0.8-1.el8pc |
| Red Hat:satellite_capsule:6.15 | python-django | 0:4.2.15-1.el8pc |
| Red Hat:satellite_capsule:6.15 | python-gunicorn | 0:22.0.0-1.el8pc |
| Red Hat:satellite_capsule:6.15 | python3.11-cryptography | 0:42.0.8-1.el8pc |
| Red Hat:satellite_capsule:6.15 | python3.11-cryptography-debuginfo | 0:42.0.8-1.el8pc |
| Red Hat:satellite_capsule:6.15 | python3.11-django | 0:4.2.15-1.el8pc |
| Red Hat:satellite_capsule:6.15 | python3.11-gunicorn | 0:22.0.0-1.el8pc |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.6.1 |
| SUSE:Package Hub 15 SP5 | python-Django | 2.2.28-bp155.7.15.1 |
| Ubuntu:20.04:LTS | python-django | 2:2.2.12-1ubuntu0.24 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.13 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.2 |
| Ubuntu:Pro:14.04:LTS | python-django | no fix |
| Ubuntu:Pro:16.04:LTS | python-django | no fix |
| Ubuntu:Pro:18.04:LTS | python-django | 1:1.11.11-1ubuntu1.21+esm6 |
| openSUSE:Leap 15.5 | python-Django | 2.2.28-bp155.7.15.1 |
| openSUSE:Leap 15.5 | python-Django | 2.0.7-150000.1.27.1 |
| openSUSE:Leap 15.6 | python-Django | 4.2.11-150600.3.6.1 |
| openSUSE:Tumbleweed | python-Django | 5.2.16-1.1 |
| openSUSE:Tumbleweed | python-Django | 5.0.8-1.1 |
| openSUSE:Tumbleweed | python-Django4 | 4.2.15-1.1 |
| openSUSE:Tumbleweed | python-Django4 | 4.2.30-4.1 |
| openSUSE:Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE:Tumbleweed | python-Django6 | 6.0-1.1 |