Bug 2261856 (CVE-2024-24680)
| Summary: | CVE-2024-24680 Django: denial-of-service in ``intcomma`` template filter | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Rohit Keshri <rkeshri> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | adudiak, apevec, bbuckingham, bcourt, brking, caswilli, dranck, eglynn, ehelms, epacific, ggainey, gtanzill, haoli, hkataria, jajackso, jcammara, jhardy, jjoyce, jmitchel, jneedle, jobarker, jschluet, jsherril, jtanner, juwatts, jweng, jwong, kaycoth, kegrant, kholdawa, koliveir, kshier, lcouzens, lhh, lsvaty, luizcosta, lzap, mabashia, mburns, mgarciac, mhulan, mminar, mskarbek, nmoumoul, nweather, omaciel, orabin, pbraun, pcreech, pgrist, rbiba, rbobbitt, rchan, rhos-maint, security-response-team, shvarugh, simaishi, smallamp, smcdonal, sskracic, stcannon, teagle, tfister, thavo, yguenane, zsadeh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | django 3.2.24, django 4.2.10, django 5.0.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was found in Django. When used with very long strings, the intcomma template filter was subject to a potential denial of service attack.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2261858, 2261859, 2261860, 2261861, 2261862, 2261863, 2261864, 2261865, 2261866, 2261867, 2263504, 2263505, 2263506, 2263507 | ||
| Bug Blocks: | 2261857 | ||
|
Description
Rohit Keshri
2024-01-30 06:41:14 UTC
Created python-django tracking bugs for this issue: Affects: epel-all [bug 2263504] Affects: fedora-all [bug 2263505] Affects: openstack-rdo [bug 2263507] Created python-django3 tracking bugs for this issue: Affects: fedora-all [bug 2263506] This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Via RHSA-2024:1057 https://access.redhat.com/errata/RHSA-2024:1057 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Via RHSA-2024:1640 https://access.redhat.com/errata/RHSA-2024:1640 This issue has been addressed in the following products: RHUI 4 for RHEL 8 Via RHSA-2024:1878 https://access.redhat.com/errata/RHSA-2024:1878 This issue has been addressed in the following products: Red Hat OpenStack Platform 17.1 for RHEL 9 Via RHSA-2024:2731 https://access.redhat.com/errata/RHSA-2024:2731 This issue has been addressed in the following products: Red Hat Satellite 6.15 for RHEL 8 Via RHSA-2024:5662 https://access.redhat.com/errata/RHSA-2024:5662 |