Resource exhaustion in Django - CVE-2024-24680

Vulnerability identifier: #VU86190

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24680

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in intcomma template filter. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Django
Debian Linux
Gentoo Linux
Ubuntu
openEuler
Anolis OS
Fedora
Nautobot
Ansible Automation Platform
Red Hat Update Infrastructure (RHUI)
Cloud Pak for Network Automation
python3-django (Ubuntu package)
python-django (Ubuntu package)
libcomps (Red Hat package)
python-sqlparse (Red Hat package)
python-json-stream-rs-tokenizer (Red Hat package)
python-gnupg (Red Hat package)
python-inflection (Red Hat package)
python-defusedxml (Red Hat package)
libsolv (Red Hat package)
python-ecdsa (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
python-pulp-glue (Red Hat package)
python-drf-spectacular (Red Hat package)
python-drf-nested-routers (Red Hat package)
python-django-lifecycle (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
createrepo_c (Red Hat package)
python-asyncio-throttle (Red Hat package)
python-brotli (Red Hat package)
python-et-xmlfile (Red Hat package)
python-django-readonly-field (Red Hat package)
python-deprecated (Red Hat package)
python-drf-access-policy (Red Hat package)
python-xlwt (Red Hat package)
python-aiosignal (Red Hat package)
python-frozenlist (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
receptor (Red Hat package)
python-aiohttp-xmlrpc (Red Hat package)
python-jq (Red Hat package)
python-yarl (Red Hat package)
python-wrapt (Red Hat package)
python-markuppy (Red Hat package)
python-opentelemetry_api (Red Hat package)
python-opentelemetry_exporter_otlp_proto_common (Red Hat package)
python-opentelemetry_exporter_otlp (Red Hat package)
python-opentelemetry_sdk (Red Hat package)
python-opentelemetry_proto (Red Hat package)
python-opentelemetry_exporter_otlp_proto_http (Red Hat package)
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package)
python-productmd (Red Hat package)
python-grpcio (Red Hat package)
python-googleapis-common-protos (Red Hat package)
pulpcore-selinux (Red Hat package)
python-urlman (Red Hat package)
python-aioredis (Red Hat package)
python-xlrd (Red Hat package)
python-markupsafe (Red Hat package)
python-backoff (Red Hat package)
python-django (Red Hat package)
python-django
python-django-help
python3-Django
python-json-stream (Red Hat package)
ansible-runner (Red Hat package)
python-pyjwt (Red Hat package)
python-pygtrie (Red Hat package)
ansible-core (Red Hat package)
python-pulp-container (Red Hat package)
python-pulp-container-client (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python-aiodns (Red Hat package)
python-django-import-export (Red Hat package)
python-openpyxl (Red Hat package)
python-pyparsing (Red Hat package)
python-jinja2 (Red Hat package)
python-psycopg (Red Hat package)
python-dynaconf (Red Hat package)
python-django (Debian package)
python-django-guid (Red Hat package)
python-tablib (Red Hat package)
python-types-cryptography (Red Hat package)
python-zipp (Red Hat package)
python-asgiref (Red Hat package)
python-aiohttp (Red Hat package)
python3x-aiohttp (Red Hat package)
python-djangorestframework (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulp-rpm (Red Hat package)
python-pulp-rpm-client (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python-pulpcore-client (Red Hat package)
python-async-timeout (Red Hat package)
python-uritemplate (Red Hat package)
python-pycares (Red Hat package)
python3-django
python3-django-bash-completion
python3-django-doc
python3x-django (Red Hat package)
python-redis (Red Hat package)
automation-controller (Red Hat package)
python-typing-extensions (Red Hat package)
rhui-tools (Red Hat package)
rhui-installer (Red Hat package)
python-jsonschema (Red Hat package)
python-protobuf (Red Hat package)
dev-python/django
python-whitenoise (Red Hat package)
python-importlib-metadata (Red Hat package)
python-multidict (Red Hat package)
python-click (Red Hat package)
python-gunicorn (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python-aiofiles (Red Hat package)
python-django-filter (Red Hat package)
python-cryptography (Red Hat package)
python-pytz (Red Hat package)
python-uuid6 (Red Hat package)
python-diff-match-patch (Red Hat package)

Install updates from vendor's website.

Django - addressed in versions 3.2.24, 4.2.10, 5.0.2
Nautobot - addressed in versions 1.6.12, 2.1.4
Cloud Pak for Network Automation - update to 2.7.1
python3-django (Ubuntu package) - addressed in versions Ubuntu Pro, 2:2.2.12-1ubuntu0.21, 2:3.2.12-2ubuntu1.10, 3:4.2.4-1ubuntu2.1
python-django (Ubuntu package) - update to Ubuntu Pro
libcomps (Red Hat package) - update to 0.1.18-8.el8ui
python-sqlparse (Red Hat package) - update to 0.4.4-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package) - update to 0.4.25-3.el8ui
python-gnupg (Red Hat package) - update to 0.5.0-4.el8ui
python-inflection (Red Hat package) - update to 0.5.1-6.el8ui
python-defusedxml (Red Hat package) - update to 0.7.1-6.el8ui
libsolv (Red Hat package) - update to 0.7.22-6.el8ui
python-ecdsa (Red Hat package) - update to 0.18.0-4.el8ui
python-pyrsistent (Red Hat package) - update to 0.18.1-5.el8ui
python-future (Red Hat package) - update to 0.18.3-4.el8ui
python-pulp-glue (Red Hat package) - update to 0.21.2-3.el8ui
python-drf-spectacular (Red Hat package) - update to 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package) - update to 0.93.4-5.el8ui
python-django-lifecycle (Red Hat package) - update to 1.0.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package) - update to 1.0.0-7.el8ui
createrepo_c (Red Hat package) - update to 1.0.2-5.el8ui
python-asyncio-throttle (Red Hat package) - update to 1.0.2-6.el8ui
python-brotli (Red Hat package) - update to 1.0.9-5.el8ui
python-et-xmlfile (Red Hat package) - update to 1.1.0-5.el8ui
python-django-readonly-field (Red Hat package) - update to 1.1.2-3.el8ui
python-deprecated (Red Hat package) - update to 1.2.13-4.el8ui
python-drf-access-policy (Red Hat package) - update to 1.3.0-3.el8ui
python-xlwt (Red Hat package) - update to 1.3.0-6.el8ui
python-aiosignal (Red Hat package) - update to 1.3.1-4.el8ui
python-frozenlist (Red Hat package) - update to 1.3.3-4.el8ui
python-odfpy (Red Hat package) - update to 1.4.1-9.el8ui
python-pyjwkest (Red Hat package) - update to 1.4.2-8.el8ui
python-url-normalize (Red Hat package) - update to 1.4.3-7.el8ui
receptor (Red Hat package) - addressed in versions 1.4.5-1.el8ap, 1.4.5-1.el9ap
python-aiohttp-xmlrpc (Red Hat package) - update to 1.5.0-5.el8ui
python-jq (Red Hat package) - update to 1.6.0-3.el8ui
python-yarl (Red Hat package) - update to 1.8.2-4.el8ui
python-wrapt (Red Hat package) - update to 1.14.1-4.el8ui
python-markuppy (Red Hat package) - update to 1.14-6.el8ui
python-opentelemetry_api (Red Hat package) - update to 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package) - update to 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_sdk (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package) - update to 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package) - update to 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package) - update to 1.19.0-5.el8ui
python-productmd (Red Hat package) - update to 1.33-6.el8ui
python-grpcio (Red Hat package) - update to 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package) - update to 1.59.1-4.el8ui
pulpcore-selinux (Red Hat package) - update to 2.0.1-1.el8ui
python-urlman (Red Hat package) - update to 2.0.1-4.el8ui
python-aioredis (Red Hat package) - update to 2.0.1-5.el8ui
python-xlrd (Red Hat package) - update to 2.0.1-8.el8ui
python-markupsafe (Red Hat package) - update to 2.1.2-4.el8ui
python-backoff (Red Hat package) - update to 2.2.1-4.el8ui
python-django (Red Hat package) - addressed in versions 2.2.24-8.el9ost, 4.2.11-1.el9ap, 4.2.11-1.el8ui
python-django - addressed in versions 2.2.27-10, 3.2.12-9
python-django-help - addressed in versions 2.2.27-10, 3.2.12-9
python3-Django - addressed in versions 2.2.27-10, 3.2.12-9
python-json-stream (Red Hat package) - update to 2.3.2-4.el8ui
ansible-runner (Red Hat package) - addressed in versions 2.3.6-1.el8ap, 2.3.6-1.el9ap
python-pyjwt (Red Hat package) - update to 2.5.0-4.el8ui
python-pygtrie (Red Hat package) - update to 2.5.0-4.el8ui
ansible-core (Red Hat package) - addressed in versions 2.15.10-1.el8ap, 2.15.10-1.el9ap
python-pulp-container (Red Hat package) - update to 2.16.4-1.el8ui
python-pulp-container-client (Red Hat package) - update to 2.16.4-1.0.1.el8ui
ansible-collection-community-crypto (Red Hat package) - update to 2.18.0-1.el8ui
python-aiodns (Red Hat package) - update to 3.0.0-6.el8ui
python-django-import-export (Red Hat package) - update to 3.1.0-3.el8ui
python-openpyxl (Red Hat package) - update to 3.1.0-4.el8ui
python-pyparsing (Red Hat package) - update to 3.1.1-3.el8ui
python-jinja2 (Red Hat package) - update to 3.1.3-1.el8ui
python-psycopg (Red Hat package) - update to 3.1.9-4.el8ui
python-dynaconf (Red Hat package) - update to 3.1.12-3.el8ui
python-django (Debian package) - update to 3:3.2.25-0+deb12u1
python-django-guid (Red Hat package) - update to 3.3.0-4.el8ui
python-tablib (Red Hat package) - update to 3.3.0-4.el8ui
python-types-cryptography (Red Hat package) - update to 3.3.23.2-4.el8ui
python-zipp (Red Hat package) - update to 3.4.0-7.el8ui
python-asgiref (Red Hat package) - update to 3.6.0-4.el8ui
python-aiohttp (Red Hat package) - addressed in versions 3.9.2-1.el8ui, 3.9.3-1.el9ap
python3x-aiohttp (Red Hat package) - update to 3.9.3-1.el8ap
python-djangorestframework (Red Hat package) - update to 3.14.0-3.el8ui
python-pycryptodomex (Red Hat package) - update to 3.14.1-5.el8ui
python-pulp-rpm (Red Hat package) - update to 3.23.0-2.el8ui
python-pulp-rpm-client (Red Hat package) - update to 3.23.0-2.0.1.el8ui
python3x-pulpcore (Red Hat package) - update to 3.28.24-1.el8ap
python-pulpcore (Red Hat package) - addressed in versions 3.28.24-1.el9ap, 3.39.11-1.el8ui
python-pulpcore-client (Red Hat package) - update to 3.39.7-1.0.1.el8ui
python-async-timeout (Red Hat package) - update to 4.0.2-5.el8ui
python-uritemplate (Red Hat package) - update to 4.1.1-5.el8ui
python-pycares (Red Hat package) - update to 4.1.2-5.el8ui
python3-django - update to 4.2.11-1
python3-django-bash-completion - update to 4.2.11-1
python3-django-doc - update to 4.2.11-1
python3x-django (Red Hat package) - update to 4.2.11-1.el8ap
python-django - addressed in versions 4.2.11-1.fc39, 4.2.11-1.fc40, 4.2.11-1.fc41
python-redis (Red Hat package) - update to 4.3.4-4.el8ui
automation-controller (Red Hat package) - addressed in versions 4.5.5-2.el8ap, 4.5.5-2.el9ap
python-typing-extensions (Red Hat package) - update to 4.7.1-4.el8ui
Red Hat Update Infrastructure (RHUI) - update to 4.8.0
rhui-tools (Red Hat package) - update to 4.8.0.1-1.el8ui
rhui-installer (Red Hat package) - update to 4.8.0.2-1.el8ui
python-jsonschema (Red Hat package) - update to 4.10.3-3.el8ui
python-protobuf (Red Hat package) - update to 4.21.6-4.el8ui
dev-python/django - update to 5.2.1
python-whitenoise (Red Hat package) - update to 6.0.0-4.el8ui
python-importlib-metadata (Red Hat package) - update to 6.0.1-4.el8ui
python-multidict (Red Hat package) - update to 6.0.4-4.el8ui
python-click (Red Hat package) - update to 8.1.3-4.el8ui
python-gunicorn (Red Hat package) - update to 20.1.0-7.1.2.el8ui
python-packaging (Red Hat package) - update to 21.3-5.el8ui
python-attrs (Red Hat package) - update to 21.4.0-5.el8ui
python-aiofiles (Red Hat package) - update to 22.1.0-4.el8ui
python-django-filter (Red Hat package) - update to 23.2-3.el8ui
python-cryptography (Red Hat package) - update to 41.0.6-1.el8ui
python-pytz (Red Hat package) - update to 2022.2.1-5.el8ui
python-uuid6 (Red Hat package) - update to 2023.5.2-4.el8ui
python-diff-match-patch (Red Hat package) - update to 20200713-6.el8ui

• https://www.djangoproject.com/weblog/2024/feb/06/security-releases/
• https://github.com/nautobot/nautobot/releases/tag/v1.6.12

• Denial of service in Django
• Ubuntu update for python-django
• Denial of service in Nautobot
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• openEuler 20.03 LTS SP1 update for python-django
• openEuler 22.03 LTS update for python-django
• openEuler 22.03 LTS SP2 update for python-django
• openEuler 22.03 LTS SP3 update for python-django
• openEuler 22.03 LTS SP1 update for python-django
• openEuler 20.03 LTS SP4 update for python-django
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Fedora 41 update for python-django
• Fedora 39 update for python-django
• Fedora 40 update for python-django
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• Resource exhaustion in Red Hat OpenStack 17 packages
• Anolis OS update for python-django
• Gentoo update for Django
• Debian update for python-django