diff --git a/advisories/github-reviewed/2024/02/GHSA-xxj9-f6rv-m3x4/GHSA-xxj9-f6rv-m3x4.json b/advisories/github-reviewed/2024/02/GHSA-xxj9-f6rv-m3x4/GHSA-xxj9-f6rv-m3x4.json new file mode 100644 index 00000000000..6a8902f3a6c --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-xxj9-f6rv-m3x4/GHSA-xxj9-f6rv-m3x4.json @@ -0,0 +1,124 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xxj9-f6rv-m3x4", + "modified": "2024-02-07T17:32:14Z", + "published": "2024-02-07T00:30:25Z", + "aliases": [ + "CVE-2024-24680" + ], + "summary": "Django denial-of-service attack in the intcomma template filter", + "details": "An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "django" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.24" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "django" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2" + }, + { + "fixed": "4.2.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "django" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0" + }, + { + "fixed": "5.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24680" + }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/16a8fe18a3b81250f4fa57e3f93f0599dc4895bc" + }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/55519d6cf8998fe4c8f5c8abffc2b10a7c3d14e9" + }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/572ea07e84b38ea8de0551f4b4eda685d91d09d2" + }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/c1171ffbd570db90ca206c30f8e2b9f691243820" + }, + { + "type": "WEB", + "url": "https://docs.djangoproject.com/en/5.0/releases/security/" + }, + { + "type": "PACKAGE", + "url": "https://github.com/django/django" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-28.yaml" + }, + { + "type": "WEB", + "url": "https://groups.google.com/forum/#%21forum/django-announce" + }, + { + "type": "WEB", + "url": "https://www.djangoproject.com/weblog/2024/feb/06/security-releases/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-07T17:32:14Z", + "nvd_published_at": "2024-02-06T22:16:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-xxj9-f6rv-m3x4/GHSA-xxj9-f6rv-m3x4.json b/advisories/unreviewed/2024/02/GHSA-xxj9-f6rv-m3x4/GHSA-xxj9-f6rv-m3x4.json deleted file mode 100644 index bdcc671c30d..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-xxj9-f6rv-m3x4/GHSA-xxj9-f6rv-m3x4.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xxj9-f6rv-m3x4", - "modified": "2024-02-07T00:30:25Z", - "published": "2024-02-07T00:30:25Z", - "aliases": [ - "CVE-2024-24680" - ], - "details": "An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24680" - }, - { - "type": "WEB", - "url": "https://docs.djangoproject.com/en/5.0/releases/security/" - }, - { - "type": "WEB", - "url": "https://groups.google.com/forum/#%21forum/django-announce" - }, - { - "type": "WEB", - "url": "https://www.djangoproject.com/weblog/2024/feb/06/security-releases/" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-06T22:16:15Z" - } -} \ No newline at end of file