USN-6946-1: Django vulnerabilities
6 August 2024
Several security issues were fixed in Django.
Releases
Packages
- python-django - High-level Python web development framework
Details
It was discovered that Django incorrectly handled certain strings in
floatformat function. An attacker could possibly use this issue to
cause a memory exhaustion. (CVE-2024-41989)
It was discovered that Django incorrectly handled very large inputs.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2024-41990)
It was discovered that Django in AdminURLFieldWidget incorrectly
handled certain inputs with a very large number of Unicode characters.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2024-41991)
It was discovered that Django incorrectly handled certain JSON objects.
An attacker could possibly use this issue to cause a potential SQL
injection. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04
LTS. (CVE-2024-42005)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 24.04
Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04
-
python-django
-
1:1.11.11-1ubuntu1.21+esm6
Available with Ubuntu Pro
-
python3-django
-
1:1.11.11-1ubuntu1.21+esm6
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.