DemoBook a demo

Vulnerability advisory

CVE-2024-45230

Published Updated OSV record ↗

Also known as BIT-django-2024-45230GHSA-5hgc-2vfp-mqvcPYSEC-2024-102

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
All commits before 6f9fea33137fee6416ff43b775aa9567440a23d36f9fea33137fee6416ff43b775aa9567440a23d3
52821001bb62b764d73e63812133f199b8fef9eb to before 8e68f938f376cf2ca22a7e8ff0bcbe1b7a5832d18e68f938f376cf2ca22a7e8ff0bcbe1b7a5832d1
84d09a547fe35e10018ab242602ca76c29ca91a1 through 84d09a547fe35e10018ab242602ca76c29ca91a1No fix listed
Also listed as affected (40)
  • 5.1
  • stable/5.1.x
  • 4.2.15
  • 5.0.8
  • 5.0.7
  • 4.2.14
  • 5.0.6
  • 4.2.13
  • 4.2.12
  • 5.0.5
  • 5.0.4
  • 4.2.11
  • 5.0.3
  • 4.2.10
  • 5.0.2
  • 4.2.9
  • 5.0.1
  • 5.0
  • 4.2.8
  • 5.0rc1
  • 4.2.7
  • 5.0b1
  • 4.2.6
  • 5.0a1
  • 4.2.5
  • 4.2.4
  • 4.2.3
  • 4.2.2
  • 4.2.1
  • 4.2
  • 4.2rc1
  • 4.2b1
  • 4.2a1
  • 1.7a2
  • 1.4
  • 1.3
  • 1.2.1
  • 1.2
  • 1.1
  • 1.0

Description

An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.