oss-security - Django CVE-2024-53907 and CVE-2024-53908

Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAN+fQHwsn21=myA6ay4=pqRVrpC4mo3eLWejcHKazzLmW+6Zqw@mail.gmail.com>
Date: Wed, 4 Dec 2024 17:42:17 +0100
From: Sarah Boyce <sarahboyce@...ngoproject.com>
To: oss-security@...ts.openwall.com
Cc: Django Security Team <security@...ngoproject.com>
Subject: Django CVE-2024-53907 and CVE-2024-53908

https://www.djangoproject.com/weblog/2024/dec/04/security-releases/

In accordance with `our security release policy
<https://docs.djangoproject.com/en/dev/internals/security/>`_, the Django
team
is issuing releases for
`Django 5.1.4 <https://docs.djangoproject.com/en/dev/releases/5.1.4/>`_,
`Django 5.0.10 <https://docs.djangoproject.com/en/dev/releases/5.0.10/>`_,
and
`Django 4.2.17 <https://docs.djangoproject.com/en/dev/releases/4.2.17/>`_.
These releases address the security issues detailed below. We encourage all
users of Django to upgrade as soon as possible.

CVE-2024-53907: Potential denial-of-service in
``django.utils.html.strip_tags()``
=================================================================================

The ``strip_tags()`` method and ``striptags`` template filter are subject
to a
potential denial-of-service attack via certain inputs containing large
sequences of nested incomplete HTML entities.

Thanks to jiangniao for the report.

This issue has severity "moderate" according to the Django security policy.

CVE-2024-53908: Potential SQL injection in ``HasKey(lhs, rhs)`` on Oracle
=========================================================================

Direct usage of the ``django.db.models.fields.json.HasKey`` lookup on
Oracle is
subject to SQL injection if untrusted data is used as a ``lhs`` value.
Applications that use the ``jsonfield.has_key`` lookup through the ``__``
syntax are
unaffected.

Thanks to Seokchan Yoon for the report.

This issue has severity "high" according to the Django security policy.


Affected supported versions
===========================

* Django main
* Django 5.1
* Django 5.0
* Django 4.2

Resolution
==========

Patches to resolve the issue have been applied to Django's
main, 5.1, 5.0, and 4.2 branches.
The patches may be obtained from the following changesets.

CVE-2024-53907: Potential denial-of-service in
django.utils.html.strip_tags()
-----------------------------------------------------------------------------

* On the `main branch <
https://github.com/django/django/commit/49ff1042aa66bb25eda87e9a8ef82f3b0ad4eeba
>`__
* On the `5.1 branch <
https://github.com/django/django/commit/bbc74a7f7eb7335e913bdb4787f22e83a9be947e
>`__
* On the `5.0 branch <
https://github.com/django/django/commit/a5a89ea28cc550c1b29b03f9e14ef3c128ec1e84
>`__
* On the `4.2 branch <
https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b
>`__

CVE-2024-53908: Potential SQL injection in HasKey(lhs, rhs) on Oracle
---------------------------------------------------------------------

* On the `main branch <
https://github.com/django/django/commit/8f8dc5a1fca7d076e749f307f6573af3512e7e99
>`__
* On the `5.1 branch <
https://github.com/django/django/commit/6943d61818e63e77b65d8b1ae65941e8f04bd87b
>`__
* On the `5.0 branch <
https://github.com/django/django/commit/ff08bb6c70aa45f83a5ef3bd0b601c7c9d1a7642
>`__
* On the `4.2 branch <
https://github.com/django/django/commit/7376bcbf508883282ffcc0f0fac5cf0ed2d6cbc5
>`__


The following releases have been issued
=======================================

* Django 5.1.4 (`download Django 5.1.4
  <https://www.djangoproject.com/m/releases/5.1/Django-5.1.4.tar.gz>`_ |
  `5.1.4 checksums
  <https://www.djangoproject.com/m/pgp/Django-5.1.4.checksum.txt>`_)
* Django 5.0.10 (`download Django 5.0.10
  <https://www.djangoproject.com/m/releases/5.0/Django-5.0.10.tar.gz>`_ |
  `5.0.10 checksums
  <https://www.djangoproject.com/m/pgp/Django-5.0.10.checksum.txt>`_)
* Django 4.2.17 (`download Django 4.2.17
  <https://www.djangoproject.com/m/releases/4.2/Django-4.2.17.tar.gz>`_ |
  `4.2.17 checksums
  <https://www.djangoproject.com/m/pgp/Django-4.2.17.checksum.txt>`_)

The PGP key ID used for this release is Sarah Boyce: `3955B19851EA96EF <
https://github.com/sarahboyce.gpg>`_

General notes regarding security reporting
==========================================

As always, we ask that potential security issues be reported via private
email
to ``security@...ngoproject.com``, and not via Django's Trac instance, nor
via
the Django Forum, nor via the django-developers list. Please see `our
security
policies <https://www.djangoproject.com/security/>`_ for further
information.
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.