p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de python-django · Page n° 3

Vulnérabilités publiées pour python-django au cours des 30 derniers jours : 4. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 159

  1. CVE-2024-56374

    Moyenne · CVSS 5.8EPSS 1,28%Correctif disponible

    CVE-2024-56374

    An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.18-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2024-53908

    Critique · CVSS 9.8EPSS 1,42%Correctif disponible

    CVE-2024-53908

    An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.17-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2024-53907

    Élevée · CVSS 7.5EPSS 1,39%Correctif disponible

    CVE-2024-53907

    An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.17-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2024-45231

    Moyenne · CVSS 5.3EPSS 0,79%Correctif disponible

    CVE-2024-45231

    An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.16-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2024-45230

    Élevée · CVSS 7.5EPSS 25,77%Correctif disponible

    CVE-2024-45230

    An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.16-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2024-41991

    Élevée · CVSS 7.5EPSS 0,95%Correctif disponible

    CVE-2024-41991

    An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.15-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2024-39330

    Moyenne · CVSS 4.3EPSS 1,01%Correctif disponible

    CVE-2024-39330

    An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.14-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2024-39329

    Moyenne · CVSS 5.3EPSS 0,89%Correctif disponible

    CVE-2024-39329

    An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.14-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2024-27351

    Moyenne · CVSS 5.3EPSS 1,85%Correctif disponible

    CVE-2024-27351

    In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.11-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2023-43665

    Élevée · CVSS 7.5EPSS 1,46%Correctif disponible

    CVE-2023-43665

    In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:4.2.6-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2023-36053

    Élevée · CVSS 7.5EPSS 2,98%Correctif disponible

    CVE-2023-36053

    In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:3.2.20-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2023-31047

    Critique · CVSS 9.8EPSS 1,39%Correctif disponible

    CVE-2023-31047

    In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:3.2.19-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2023-24580

    Élevée · CVSS 7.5EPSS 62,58%Correctif disponible

    CVE-2023-24580

    An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

    python-djangoSystèmes d’exploitation
    • Mettez à jour vers 3:3.2.18-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →