Django denial-of-service attack in the intcomma template filter
An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-24680US | high7.5 | — | ||
An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attac… | ||||
02
references
External citations — patches, advisories, analysis.
- https://docs.djangoproject.com/en/5.0/releases/securityWEB
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/16a8fe18a3b81250f4fa57e3f93f0599dc4895bcWEB
- https://github.com/django/django/commit/55519d6cf8998fe4c8f5c8abffc2b10a7c3d14e9WEB
- https://github.com/django/django/commit/572ea07e84b38ea8de0551f4b4eda685d91d09d2WEB
- https://github.com/django/django/commit/c1171ffbd570db90ca206c30f8e2b9f691243820WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-28.yamlWEB
- https://groups.google.com/forum/#%21forum/django-announceWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan