======================================================================

                                 CERT-Renater

                     Note d'Information No. 2024/VULN318
_____________________________________________________________________

DATE                : 10/07/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Django versions prior to 5.0.7,
                                          4.2.14.

=====================================================================
https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
_____________________________________________________________________

Django security releases issued: 5.0.7 and 4.2.14
Posted by Natalia Bidart on juillet 9, 2024

In accordance with our security release policy, the Django team is
issuing releases for Django 5.0.7 and Django 4.2.14. These releases
address the security issues detailed below. We encourage all users
of Django to upgrade as soon as possible.


CVE-2024-38875: Potential denial-of-service in django.utils.html.urlize()

urlize() and urlizetrunc() were subject to a potential
denial-of-service attack via certain inputs with a very large number
of brackets.

Thanks to Elias Myllymäki for the report.

This issue has severity "moderate" according to the Django security
policy.


CVE-2024-39329: Username enumeration through timing difference for
users with unusable passwords

The django.contrib.auth.backends.ModelBackend.authenticate() method
allowed remote attackers to enumerate users via a timing attack
involving login requests for users with unusable passwords.

This issue has severity "low" according to the Django security
policy.


CVE-2024-39330: Potential directory-traversal in
django.core.files.storage.Storage.save()

Derived classes of the django.core.files.storage.Storage base
class which override generate_filename() without replicating the
file path validations existing in the parent class, allowed for
potential directory-traversal via certain inputs when calling
save().

Built-in Storage sub-classes were not affected by this
vulnerability.

Thanks to Josh Schneier for the report.

This issue has severity "low" according to the Django security
policy.


CVE-2024-39614: Potential denial-of-service in
django.utils.translation.get_supported_language_variant()

get_supported_language_variant() was subject to a potential
denial-of-service attack when used with very long strings
containing specific characters.

To mitigate this vulnerability, the language code provided to
get_supported_language_variant() is now parsed up to a maximum
length of 500 characters.

Thanks to MProgrammer for the report.

This issue has severity "moderate" according to the Django
security policy.


Affected supported versions

     Django main branch
     Django 5.1 (currently at beta status)
     Django 5.0
     Django 4.2


Resolution

Patches to resolve the issue have been applied to Django's
main, 5.1, 5.0, and 4.2 branches. The patches may be obtained
from the following changesets.


CVE-2024-38875: Potential denial-of-service in
django.utils.html.urlize()

     On the main branch
     On the 5.1 branch
     On the 5.0 branch
     On the 4.2 branch

CVE-2024-39329: Username enumeration through timing difference for
users with unusable passwords

     On the main branch
     On the 5.1 branch
     On the 5.0 branch
     On the 4.2 branch

CVE-2024-39330: Potential directory-traversal in
django.core.files.storage.Storage.save()

     On the main branch
     On the 5.1 branch
     On the 5.0 branch
     On the 4.2 branch

CVE-2024-39614: Potential denial-of-service in
django.utils.translation.get_supported_language_variant()

     On the main branch
     On the 5.1 branch
     On the 5.0 branch
     On the 4.2 branch

The following releases have been issued

     Django 5.0.7 (download Django 5.0.7 | 5.0.7 checksums)
     Django 4.2.14 (download Django 4.2.14 | 4.2.14 checksums)

The PGP key ID used for this release is Natalia Bidart:
2EE82A8D9470983E


General notes regarding security reporting

As always, we ask that potential security issues be reported via
private email to security@djangoproject.com, and not via Django's
Trac instance, nor via the Django Forum, nor via the
django-developers list. Please see our security policies for
further information.



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================