Bug 2309747

Summary:	CVE-2024-45230: Potential denial-of-service vulnerability in django.utils.html.urlize()
Product:	[Fedora] Fedora	Reporter:	Michel Lind <michel>
Component:	python-django4.2	Assignee:	Michel Lind <michel>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	michel, python-packagers-sig
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
URL:	https://www.djangoproject.com/weblog/2024/sep/03/security-releases/
Whiteboard:
Fixed In Version:	python-django4.2-4.2.16-1.fc42 python-django4.2-4.2.16-1.el9 python-django4.2-4.2.16-1.fc39 python-django4.2-4.2.16-1.fc40 python-django4.2-4.2.16-1.fc41	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-09-06 00:41:45 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Michel Lind 2024-09-04 16:03:31 UTC

urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

This issue has severity "moderate" according to the Django security policy.

Reproducible: Always

Comment 1 Fedora Update System 2024-09-04 16:57:36 UTC

FEDORA-2024-a1e99ae253 (python-django4.2-4.2.16-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-a1e99ae253

Comment 2 Fedora Update System 2024-09-04 17:07:36 UTC

FEDORA-2024-a1e99ae253 (python-django4.2-4.2.16-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 3 Fedora Update System 2024-09-04 18:26:21 UTC

FEDORA-2024-28892f7c8f (python-django4.2-4.2.16-1.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-28892f7c8f

Comment 4 Fedora Update System 2024-09-04 18:26:21 UTC

FEDORA-EPEL-2024-92f7377188 (python-django4.2-4.2.16-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-92f7377188

Comment 5 Fedora Update System 2024-09-04 18:26:22 UTC

FEDORA-2024-b08735561c (python-django4.2-4.2.16-1.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-b08735561c

Comment 6 Fedora Update System 2024-09-05 00:23:58 UTC

FEDORA-EPEL-2024-92f7377188 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-92f7377188

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2024-09-05 01:49:34 UTC

FEDORA-2024-28892f7c8f has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-28892f7c8f`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-28892f7c8f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2024-09-05 03:02:27 UTC

FEDORA-2024-b08735561c has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-b08735561c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-b08735561c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2024-09-05 03:29:14 UTC

FEDORA-2024-865828665c has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-865828665c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-865828665c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2024-09-06 00:41:45 UTC

FEDORA-EPEL-2024-92f7377188 (python-django4.2-4.2.16-1.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Fedora Update System 2024-09-06 03:53:15 UTC

FEDORA-2024-28892f7c8f (python-django4.2-4.2.16-1.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 12 Fedora Update System 2024-09-06 04:03:28 UTC

FEDORA-2024-865828665c (python-django4.2-4.2.16-1.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2024-09-13 20:51:31 UTC

FEDORA-2024-b08735561c (python-django4.2-4.2.16-1.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.