CVE-2024-56374

{"id": "CVE-2024-56374", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-01-14T19:15:32.510", "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "source": "cve@mitre.org"}, {"url": "https://groups.google.com/g/django-announce", "source": "cve@mitre.org"}, {"url": "https://www.djangoproject.com/weblog/2025/jan/14/security-releases/", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/01/14/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00024.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)"}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Django 5.1 antes de 5.1.5, 5.0 antes de 5.0.11 y 4.2 antes de 4.2.18. La falta de aplicaci\u00f3n de un l\u00edmite superior en las cadenas que se pasan al realizar la validaci\u00f3n de IPv6 podr\u00eda provocar un posible ataque de denegaci\u00f3n de servicio. Las funciones privadas y no documentadas clean_ipv6_address e is_valid_ipv6_address son vulnerables, al igual que el campo de formulario django.forms.GenericIPAddressField. (El campo de modelo django.db.models.GenericIPAddressField no se ve afectado)."}], "lastModified": "2025-01-23T18:15:32.820", "sourceIdentifier": "cve@mitre.org"}