id: PYSEC-2024-156
modified: 2025-01-14T05:22:11.736011Z
published: 2024-12-06T12:15:17Z
aliases:
- CVE-2024-53907
- GHSA-8498-2h75-472j
details: An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and
  4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject
  to a potential denial-of-service attack via certain inputs containing large sequences
  of nested incomplete HTML entities.
affected:
- package:
    ecosystem: PyPI
    name: django
    purl: pkg:pypi/django
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "5.1"
    - fixed: 5.1.4
    - introduced: "5.0"
    - fixed: 5.0.10
    - introduced: "4.2"
    - fixed: 4.2.17
  versions:
  - "4.2"
  - 4.2.1
  - 4.2.10
  - 4.2.11
  - 4.2.12
  - 4.2.13
  - 4.2.14
  - 4.2.15
  - 4.2.16
  - 4.2.2
  - 4.2.3
  - 4.2.4
  - 4.2.5
  - 4.2.6
  - 4.2.7
  - 4.2.8
  - 4.2.9
  - "5.0"
  - 5.0.1
  - 5.0.2
  - 5.0.3
  - 5.0.4
  - 5.0.5
  - 5.0.6
  - 5.0.7
  - 5.0.8
  - 5.0.9
  - "5.1"
  - 5.1.1
  - 5.1.2
  - 5.1.3
references:
- type: WEB
  url: https://docs.djangoproject.com/en/dev/releases/security/
- type: WEB
  url: https://groups.google.com/g/django-announce
- type: WEB
  url: https://www.openwall.com/lists/oss-security/2024/12/04/3
- type: WEB
  url: https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8498-2h75-472j