PyPI/django CVE-2024-45230: medium 5.3, EPSS 25.77%

Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters

Action: Upgrade django to 4.2.16 or later.

pip install django==5.1.1

pip install django==5.0.9

pip install django==4.2.16

Affected

Fixed versions

Sources

• osv: GHSA-5hgc-2vfp-mqvc
• https://nvd.nist.gov/vuln/detail/CVE-2024-45230
• https://github.com/django/django/commit/022ab0a75c76ab2ea31dfcc5f2cf5501e378d397
• https://github.com/django/django/commit/813de2672bd7361e9a453ab62cd6e52f96b6525b
• https://github.com/django/django/commit/d147a8ebbdf28c17cafbbe2884f0bc57e2bf82e2
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-102.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases

CVE-2024-45230 · published 2024-10-08T18:33:13Z · modified 2024-10-30T19:23:43.662562Z · JSON