CVE-2024-53907
Fixed in a distro release EPSS 1%CVSS 7.5
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 5.1.4 |
| PyPI | django | 4.2.17 |
| PyPI | django | 5.0.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | awx | 24.6.1-r2 |
| Chainguard | py3-django | 5.1.4-r0 |
| Chainguard | py3-supported-django | 5.1.4-r0 |
| Chainguard | py3.10-django | 5.1.4-r0 |
| Chainguard | py3.10-django-bin | 5.1.4-r0 |
| Chainguard | py3.11-django | 5.1.4-r0 |
| Chainguard | py3.11-django-bin | 5.1.4-r0 |
| Chainguard | py3.12-django | 5.1.4-r0 |
| Chainguard | py3.12-django-bin | 5.1.4-r0 |
| Chainguard | py3.13-django | 5.1.4-r0 |
| Chainguard | py3.13-django-bin | 5.1.4-r0 |
| Debian:11 | python-django | 2:2.2.28-1~deb11u3 |
| Debian:12 | python-django | 3:3.2.25-0+deb12u1 |
| Debian:13 | python-django | 3:4.2.17-1 |
| Debian:14 | python-django | 3:4.2.17-1 |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-venv-tower | 0:4.6.7-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-venv-tower | 0:4.6.6-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-venv-tower | 0:4.6.6-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-venv-tower | 0:4.6.7-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | automation-gateway-server | 0:2.5.20250115-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | automation-gateway-server | 0:2.5.20250115-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-aiohttp | 0:3.10.11-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-aiohttp | 0:3.10.11-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-aiohttp-debuginfo | 0:3.10.11-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-aiohttp-debuginfo | 0:3.10.11-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-aiohttp-debugsource | 0:3.10.11-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-aiohttp-debugsource | 0:3.10.11-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-django | 0:4.2.18-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-django | 0:4.2.18-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-jinja2 | 0:3.1.5-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-jinja2 | 0:3.1.5-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.5 | python3.11-django | 0:4.2.18-1.el8ap |
| Red Hat:ansible_automation_platform_developer:2.5 | python3.11-django | 0:4.2.18-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.5 | python3.11-jinja2 | 0:3.1.5-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.5 | python3.11-jinja2 | 0:3.1.5-1.el8ap |
| Red Hat:ansible_automation_platform_inside:2.5 | python3.11-jinja2 | 0:3.1.5-1.el9ap |
| Red Hat:ansible_automation_platform_inside:2.5 | python3.11-jinja2 | 0:3.1.5-1.el8ap |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.12.1 |
| SUSE:Package Hub 15 SP5 | python-Django | 2.2.28-bp155.7.21.1 |
| Ubuntu:20.04:LTS | python-django | 2:2.2.12-1ubuntu0.26 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.15 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.4 |
| Ubuntu:Pro:14.04:LTS | python-django | no fix |
| Ubuntu:Pro:16.04:LTS | python-django | 1.8.7-1ubuntu5.15+esm8 |
| Ubuntu:Pro:18.04:LTS | python-django | 1:1.11.11-1ubuntu1.21+esm8 |
| Wolfi | py3-django | 5.1.4-r0 |
| Wolfi | py3-supported-django | 5.1.4-r0 |
| Wolfi | py3.10-django | 5.1.4-r0 |
| Wolfi | py3.10-django-bin | 5.1.4-r0 |
| Wolfi | py3.11-django | 5.1.4-r0 |
| Wolfi | py3.11-django-bin | 5.1.4-r0 |
| Wolfi | py3.12-django | 5.1.4-r0 |
| Wolfi | py3.12-django-bin | 5.1.4-r0 |
| Wolfi | py3.13-django | 5.1.4-r0 |
| Wolfi | py3.13-django-bin | 5.1.4-r0 |
| openSUSE:Leap 15.5 | python-Django | 2.2.28-bp155.7.21.1 |
| openSUSE:Leap 15.6 | python-Django | 4.2.11-150600.3.12.1 |
| openSUSE:Tumbleweed | python-Django | 5.1.4-1.1 |
| openSUSE:Tumbleweed | python-Django4 | 4.2.17-1.1 |
| openSUSE:Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE:Tumbleweed | python-Django6 | 6.0-1.1 |