{"title":"Django 5.0.7 release notes","version":"dev","locale":"en","docname":"releases/5.0.7","url":"/en/dev/releases/5.0.7/","canonical":"https://djangodocs.dev/en/dev/releases/5.0.7/","summary":"Django 5.0.7 fixes two security issues with severity “moderate”, two security issues with severity “low”, and one bug in 5.0.6.","html":"

Django 5.0.7 release notesLink to this heading#

\n

July 9, 2024

\n

Django 5.0.7 fixes two security issues with severity “moderate”, two security\nissues with severity “low”, and one bug in 5.0.6.

\n
\n

CVE-2024-38875: Potential denial-of-service vulnerability in django.utils.html.urlize()Link to this heading#

\n

urlize and urlizetrunc were subject to a potential\ndenial-of-service attack via certain inputs with a very large number of\nbrackets.

\n
\n
\n

CVE-2024-39329: Username enumeration through timing difference for users with unusable passwordsLink to this heading#

\n

The authenticate() method\nallowed remote attackers to enumerate users via a timing attack involving login\nrequests for users with unusable passwords.

\n
\n
\n

CVE-2024-39330: Potential directory-traversal via Storage.save()Link to this heading#

\n

Derived classes of the Storage base class\nwhich override generate_filename() without replicating\nthe file path validations existing in the parent class, allowed for potential\ndirectory-traversal via certain inputs when calling save().

\n

Built-in Storage sub-classes were not affected by this vulnerability.

\n
\n
\n

CVE-2024-39614: Potential denial-of-service vulnerability in get_supported_language_variant()Link to this heading#

\n

get_supported_language_variant() was subject to\na potential denial-of-service attack when used with very long strings\ncontaining specific characters.

\n

To mitigate this vulnerability, the language code provided to\nget_supported_language_variant() is now parsed\nup to a maximum length of 500 characters.

\n

When the language code is over 500 characters, a ValueError will now be\nraised if strict is True, or if there is no generic variant and\nstrict is False.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-5-0-7-release-notes","toc":[{"title":"CVE-2024-38875: Potential denial-of-service vulnerability in django.utils.html.urlize()","anchor":"cve-2024-38875-potential-denial-of-service-vulnerability-in-django-utils-html-urlize","children":[]},{"title":"CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords","anchor":"cve-2024-39329-username-enumeration-through-timing-difference-for-users-with-unusable-passwords","children":[]},{"title":"CVE-2024-39330: Potential directory-traversal via Storage.save()","anchor":"cve-2024-39330-potential-directory-traversal-via-storage-save","children":[]},{"title":"CVE-2024-39614: Potential denial-of-service vulnerability in get_supported_language_variant()","anchor":"cve-2024-39614-potential-denial-of-service-vulnerability-in-get-supported-language-variant","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/5.0.8","title":"Django 5.0.8 release notes","url":"/en/dev/releases/5.0.8/"},"next":{"docname":"releases/5.0.6","title":"Django 5.0.6 release notes","url":"/en/dev/releases/5.0.6/"},"formats":{"html":"/en/dev/releases/5.0.7/","markdown":"/en/dev/releases/5.0.7.md","json":"/en/dev/releases/5.0.7.json"},"source":"https://github.com/django/django/blob/main/docs/releases/5.0.7.txt","official":"https://docs.djangoproject.com/en/dev/releases/5.0.7/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0"],"inLocales":["en"]}