Debian: CVE-2024-56374: python-django -- security update

Debian: CVE-2024-56374: python-django -- security update

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

01/14/2025

Created

01/28/2025

Added

01/27/2025

Modified

01/27/2025

Description

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

Solution(s)

• debian-upgrade-python-django

References

• https://attackerkb.com/topics/cve-2024-56374
• CVE - 2024-56374
• DLA-4030-1