PYSEC-2024-156

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2024-156.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2024-156

Aliases

Published

2024-12-06T12:15:17Z

Modified

2025-01-14T05:57:05.915961Z

Summary

[none]

Details

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

References

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.1

Fixed

5.1.4

Introduced

5.0

Fixed

5.0.10

Introduced

4.2

Fixed

4.2.17

Affected versions

4.*

4.2

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.2.8

4.2.9

4.2.10

4.2.11

4.2.12

4.2.13

4.2.14

4.2.15

4.2.16

5.*

5.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.1

5.1.1

5.1.2

5.1.3