Django: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 7.5
  CVE-2024-38875

  Django vulnerable to Denial of Service

  An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• High 7.5
  CVE-2024-39614 Public exploit EPSS 29%

  Django vulnerable to Denial of Service

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• Medium 5.3
  CVE-2024-39329

  Django vulnerable to user enumeration attack

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable pa…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• Medium 4.3
  CVE-2024-39330

  Django Path Traversal vulnerability

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentia…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024

Revision history

1. 2026-07-13 #17

   Neue Updates von openSUSE aufgenommen

2. 2026-07-12 #16

   Neue Updates von openSUSE aufgenommen

3. 2026-02-15 #15

   Neue Updates von Debian aufgenommen

4. 2026-01-28 #14

   Neue Updates von Debian aufgenommen

5. 2026-01-04 #13

   Neue Updates von openSUSE aufgenommen

6. 2025-09-17 #12

   Neue Updates von Gentoo aufgenommen

7. 2025-02-11 #11

   Neue Updates von Red Hat aufgenommen

8. 2025-01-12 #10

   Neue Updates von XEROX aufgenommen

9. 2024-11-13 #9

   Neue Updates von Red Hat aufgenommen

10. 2024-11-05 #8

    Neue Updates von Red Hat aufgenommen

11. 2024-09-05 #7

    Neue Updates von Red Hat aufgenommen

12. 2024-08-18 #6

    Neue Updates von openSUSE aufgenommen

13. 2024-07-22 #5

    Neue Updates von SUSE aufgenommen

14. 2024-07-17 #4

    Neue Updates von SUSE aufgenommen

15. 2024-07-11 #3

    Neue Updates von Ubuntu aufgenommen

16. 2024-07-10 #2

    Neue Updates von Fedora aufgenommen

17. 2024-07-09 #1

    Initiale Fassung

References

• Django security releases vom 2024-07-09
  https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
• Ubuntu Security Notice USN-6888-1 vom 2024-07-09
  https://ubuntu.com/security/notices/USN-6888-1
• Fedora Security Advisory FEDORA-2024-D05D37EAD7 vom 2024-07-10
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-d05d37ead7
• Fedora Security Advisory FEDORA-2024-82547E3E16 vom 2024-07-10
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-82547e3e16
• Fedora Security Advisory FEDORA-2024-A7EEF0CA7B vom 2024-07-10
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-a7eef0ca7b
• Fedora Security Advisory FEDORA-2024-7DAC82A14E vom 2024-07-10
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-7dac82a14e
• Fedora Security Advisory FEDORA-EPEL-2024-998AB9C7FA vom 2024-07-10
  https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-998ab9c7fa
• Ubuntu Security Notice USN-6888-2 vom 2024-07-11
  https://ubuntu.com/security/notices/USN-6888-2
• SUSE Security Update SUSE-SU-2024:2545-1 vom 2024-07-17
  https://lists.suse.com/pipermail/sle-security-updates/2024-July/018995.html
• SUSE Security Update SUSE-SU-2024:2577-1 vom 2024-07-22
  https://lists.suse.com/pipermail/sle-security-updates/2024-July/019014.html
• openSUSE Security Update OPENSUSE-SU-2024:0251-1 vom 2024-08-18
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OU4KXNSFOQVRSGL2OQCMRA3EFMPZEGEU/
• Red Hat Security Advisory RHSA-2024:6428 vom 2024-09-05
  https://access.redhat.com/errata/RHSA-2024:6428
• Red Hat Security Advisory RHSA-2024:8906 vom 2024-11-05
  https://access.redhat.com/errata/RHSA-2024:8906
• Red Hat Security Advisory RHSA-2024:9481 vom 2024-11-13
  https://access.redhat.com/errata/RHSA-2024:9481
• XEROX Security Advisory XRX25-001 vom 2025-01-13
  https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-001-for-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf
• Red Hat Security Advisory RHSA-2025:1335 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1335
• Gentoo Linux Security Advisory GLSA-202509-03 vom 2025-09-18
  https://security.gentoo.org/glsa/202509-03
• openSUSE Security Update OPENSUSE-SU-2026:10005-1 vom 2026-01-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q2P2OLHVQPGSXDJWCLPISPE3TAXPLR5K/
• Debian Security Advisory DLA-4458 vom 2026-01-28
  https://lists.debian.org/debian-lts-announce/2026/01/msg00030.html
• Debian Security Advisory DSA-6136 vom 2026-02-15
  https://lists.debian.org/debian-security-announce/2026/msg00045.html
• openSUSE Security Update OPENSUSE-SU-2026:11235-1 vom 2026-07-12
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MICNEKX3E6PJLOS7QIODEVGAQPBIRJFR/
• openSUSE Security Update OPENSUSE-SU-2026:11248-1 vom 2026-07-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DQTK3WOVJI54HZEK4CRQPFWBUXGP4RNI/