Django 4.2.15 release notesLien vers cette rubrique
August 6, 2024
Django 4.2.15 fixes three security issues with severity « moderate », one security issue with severity « high », and a regression in 4.2.14.
CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat()Lien vers cette rubrique
If floatformat received a string representation of a number in
scientific notation with a large exponent, it could lead to significant memory
consumption.
To avoid this, decimals with more than 200 digits are now returned as is.
CVE-2024-41990: Potential denial-of-service vulnerability in django.utils.html.urlize()Lien vers cette rubrique
urlize and urlizetrunc were subject to a potential
denial-of-service attack via very large inputs with a specific sequence of
characters.
CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidgetLien vers cette rubrique
urlize, urlizetrunc, and AdminURLFieldWidget were
subject to a potential denial-of-service attack via certain inputs with a very
large number of Unicode characters.
CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()Lien vers cette rubrique
QuerySet.values() and values_list() methods on models
with a JSONField were subject to SQL injection in column aliases, via a
crafted JSON object key as a passed *arg.
Correction de boguesLien vers cette rubrique
Fixed a regression in Django 4.2.14 that caused a crash in
LocaleMiddlewarewhen processing a language code over 500 characters (#35627).