SecuriTricks - CVE-2024-56374

Description

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

Product(s) Impacted

Product	Versions
Django	4.2 before 4.2.18 5.0 before 5.0.11 5.1 before 5.1.5

Weaknesses

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://docs.djangoproject.com/en/dev/releases/security/

https://groups.google.com/g/django-announce

https://www.djangoproject.com/weblog/2025/jan/14/security-releases/

http://www.openwall.com/lists/oss-security/2025/01/14/2

https://lists.debian.org/debian-lts-announce/2025/01/msg00024.html

CVSS Score

5.8 / 10

CVSS Data

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: CHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: LOW

View Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Date

Published: Jan. 14, 2025, 7:15 p.m.
Last Modified: Jan. 23, 2025, 6:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2024-56374