DemoBook a demo

Vulnerability advisory

CVE-2024-56374

Published Updated OSV record ↗

Also known as BIT-django-2024-56374GHSA-qcgg-j2x8-h9g8PYSEC-2025-1

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before a7b0e50eadba8f0420013605c70eb790280b0fd2a7b0e50eadba8f0420013605c70eb790280b0fd2
52821001bb62b764d73e63812133f199b8fef9eb to before 67bb624b2d3099aee4d8d8bca8a004111bfabfaa67bb624b2d3099aee4d8d8bca8a004111bfabfaa
84d09a547fe35e10018ab242602ca76c29ca91a1 to before 3d3d7f5052edb99bafaa5a2f1a7dd5b9686437273d3d7f5052edb99bafaa5a2f1a7dd5b968643727

Description

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.