Skip to content

Risk: Django has a potential denial-of-service vulnerability in IPv6 validation #34

@radah19

Description

@radah19

https://github.com/radah19/vibes-app/security/dependabot/3

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

Seems like we're being urged by Github to update from Django 5.1.4 to 5.1.5 - update it and test to see if Django is fine with the update.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions