id: PYSEC-2024-28
modified: 2024-02-07T00:25:46.826634Z
published: 2024-02-06T22:16:00Z
aliases:
- CVE-2024-24680
- GHSA-xxj9-f6rv-m3x4
details: An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and
  Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential
  denial-of-service attack when used with very long strings.
affected:
- package:
    ecosystem: PyPI
    name: django
    purl: pkg:pypi/django
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "3.2"
    - fixed: 3.2.24
    - introduced: "4.2"
    - fixed: 4.2.10
    - introduced: "5.0"
    - fixed: 5.0.2
  versions:
  - "3.2"
  - 3.2.1
  - 3.2.10
  - 3.2.11
  - 3.2.12
  - 3.2.13
  - 3.2.14
  - 3.2.15
  - 3.2.16
  - 3.2.17
  - 3.2.18
  - 3.2.19
  - 3.2.2
  - 3.2.20
  - 3.2.21
  - 3.2.22
  - 3.2.23
  - 3.2.3
  - 3.2.4
  - 3.2.5
  - 3.2.6
  - 3.2.7
  - 3.2.8
  - 3.2.9
  - "4.2"
  - 4.2.1
  - 4.2.2
  - 4.2.3
  - 4.2.4
  - 4.2.5
  - 4.2.6
  - 4.2.7
  - 4.2.8
  - 4.2.9
  - "5.0"
  - 5.0.1
references:
- type: WEB
  url: https://groups.google.com/forum/#%21forum/django-announce
- type: WEB
  url: https://docs.djangoproject.com/en/5.0/releases/security/
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2024/feb/06/security-releases/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-xxj9-f6rv-m3x4