CVE-2024-39614
Publication date 9 July 2024
Last updated 24 July 2024
Ubuntu priority
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.
Status
Package | Ubuntu Release | Status |
---|---|---|
python-django | 24.04 LTS noble |
Fixed 3:4.2.11-1ubuntu1.1
|
22.04 LTS jammy |
Fixed 2:3.2.12-2ubuntu1.12
|
|
20.04 LTS focal |
Fixed 2:2.2.12-1ubuntu0.23
|
|
18.04 LTS bionic |
Fixed 1:1.11.11-1ubuntu1.21+esm5
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
alexmurray
upstream advises that only versions 4.2, 5.0 and 5.1 (plus main development branch) are affected but it is likely earlier versions may also be affected but upstream do not mention this as they are no longer maintained by them
References
Related Ubuntu Security Notices (USN)
- USN-6888-1
- Django vulnerabilities
- 9 July 2024
- USN-6888-2
- Django vulnerabilities
- 11 July 2024