CVE-2024-53907

一、漏洞信息
漏洞编号：CVE-2024-53907
漏洞归属组件：python-django
漏洞归属的版本：1.11.13,1.11.18,2.2.19,2.2.27,2.2.3,3.2.12,3.2.16,4.1.4,4.1.7,4.2.15,4.2.3,5.0.8,5.1
CVSS V3.0分值：
BaseScore：7.5 High
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.
漏洞公开时间：2024-12-06 20:15:17
漏洞创建时间：2024-12-06 00:50:58
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2024-53907

更多参考(点击展开)

参考来源	参考链接	来源链接
cve.mitre.org	https://docs.djangoproject.com/en/dev/releases/security/
cve.mitre.org	https://groups.google.com/g/django-announce
cve.mitre.org	https://www.openwall.com/lists/oss-security/2024/12/04/3
suse_bugzilla	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-53907	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://seclists.org/oss-sec/2024/q4/144	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://github.com/django/django/commit/8f8dc5a1fca7d076e749f307f6573af3512e7e99	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://github.com/django/django/commit/49ff1042aa66bb25eda87e9a8ef82f3b0ad4eeba	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://github.com/django/django/commit/6943d61818e63e77b65d8b1ae65941e8f04bd87b	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://github.com/django/django/commit/7376bcbf508883282ffcc0f0fac5cf0ed2d6cbc5	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://github.com/django/django/commit/a5a89ea28cc550c1b29b03f9e14ef3c128ec1e84	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://github.com/django/django/commit/bbc74a7f7eb7335e913bdb4787f22e83a9be947e	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://github.com/django/django/commit/ff08bb6c70aa45f83a5ef3bd0b601c7c9d1a7642	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b	https://bugzilla.suse.com/show_bug.cgi?id=1234232
suse_bugzilla	https://bugzilla.redhat.com/show_bug.cgi?id=2329288	https://bugzilla.suse.com/show_bug.cgi?id=1234232
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2024:11144	https://bugzilla.redhat.com/show_bug.cgi?id=2329288
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2024:11146	https://bugzilla.redhat.com/show_bug.cgi?id=2329288
debian		https://security-tracker.debian.org/tracker/CVE-2024-53907

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)

影响的包	修复版本	修复补丁	问题引入补丁	来源
		https://github.com/django/django/commit/8f8dc5a1fca7d076e749f307f6573af3512e7e99		suse_bugzilla
		https://github.com/django/django/commit/49ff1042aa66bb25eda87e9a8ef82f3b0ad4eeba		suse_bugzilla
		https://github.com/django/django/commit/6943d61818e63e77b65d8b1ae65941e8f04bd87b		suse_bugzilla
		https://github.com/django/django/commit/7376bcbf508883282ffcc0f0fac5cf0ed2d6cbc5		suse_bugzilla
		https://github.com/django/django/commit/a5a89ea28cc550c1b29b03f9e14ef3c128ec1e84		suse_bugzilla
		https://github.com/django/django/commit/bbc74a7f7eb7335e913bdb4787f22e83a9be947e		suse_bugzilla
		https://github.com/django/django/commit/ff08bb6c70aa45f83a5ef3bd0b601c7c9d1a7642		suse_bugzilla
		https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b		suse_bugzilla
		https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b		debian

二、漏洞分析结构反馈
影响性分析说明：
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.
openEuler评分：
7.5
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(5.1):受影响
2.openEuler-20.03-LTS-SP4(2.2.27):受影响
3.openEuler-22.03-LTS-SP1(4.2.15):受影响
4.openEuler-22.03-LTS-SP3(4.2.15):受影响
5.openEuler-24.03-LTS(4.2.15):受影响
6.openEuler-24.03-LTS-Next(4.2.15):受影响
7.openEuler-22.03-LTS-SP4(4.2.15):受影响
8.openEuler-24.03-LTS-SP1(4.2.15):受影响

修复是否涉及abi变化(是/否)：
1.master(5.1):否
2.openEuler-20.03-LTS-SP4(2.2.27):否
3.openEuler-22.03-LTS-SP1(4.2.15):否
4.openEuler-22.03-LTS-SP3(4.2.15):否
5.openEuler-24.03-LTS(4.2.15):否
6.openEuler-24.03-LTS-Next(4.2.15):否
7.openEuler-22.03-LTS-SP4(4.2.15):否
8.openEuler-24.03-LTS-SP1(4.2.15):否

原因说明：
1.master(5.1):正常修复
2.openEuler-20.03-LTS-SP4(2.2.27):正常修复
3.openEuler-22.03-LTS-SP1(4.2.15):正常修复
4.openEuler-22.03-LTS-SP3(4.2.15):正常修复
5.openEuler-24.03-LTS(4.2.15):正常修复
6.openEuler-24.03-LTS-Next(4.2.15):正常修复
7.openEuler-22.03-LTS-SP4(4.2.15):正常修复
8.openEuler-24.03-LTS-SP1(4.2.15):正常修复

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2543

@myeuler ,@yangzhao_kl ,@shinwell_hu ,@cherry530 ,@randy1568 
**issue处理注意事项:** 
**1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;**
**2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;**
**3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否), 原因说明)不能省略,省略后cve-manager将无法正常解析填写内容.**
************************************************************************
影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响): 
1.master(4.2.3):
2.openEuler-20.03-LTS-SP4(2.2.27):
3.openEuler-22.03-LTS-SP1(3.2.12):
4.openEuler-22.03-LTS-SP3(3.2.12):
5.openEuler-22.03-LTS-SP4(3.2.12):
6.openEuler-24.03-LTS(4.2.3):
7.openEuler-24.03-LTS-Next(4.2.3):
8.openEuler-24.03-LTS-SP1:

修复是否涉及abi变化(是/否)：
1.master(4.2.3):
2.openEuler-20.03-LTS-SP4(2.2.27):
3.openEuler-22.03-LTS-SP1(3.2.12):
4.openEuler-22.03-LTS-SP3(3.2.12):
5.openEuler-22.03-LTS-SP4(3.2.12):
6.openEuler-24.03-LTS(4.2.3):
7.openEuler-24.03-LTS-Next(4.2.3):
8.openEuler-24.03-LTS-SP1:

原因说明：
1.master(4.2.3):
2.openEuler-20.03-LTS-SP4(2.2.27):
3.openEuler-22.03-LTS-SP1(3.2.12):
4.openEuler-22.03-LTS-SP3(3.2.12):
5.openEuler-22.03-LTS-SP4(3.2.12):
6.openEuler-24.03-LTS(4.2.3):
7.openEuler-24.03-LTS-Next(4.2.3):
8.openEuler-24.03-LTS-SP1:

issue处理具体操作请参考: 
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

影响性分析说明：
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

openEuler评分：
BaseScore：7.5 High
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：
1.master:受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP1:受影响
4.openEuler-22.03-LTS-SP3:受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:受影响
7.openEuler-22.03-LTS-SP4:受影响
8.openEuler-24.03-LTS-SP1:受影响

修复是否涉及abi变化(是/否)：
1.master:否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP1:否
4.openEuler-22.03-LTS-SP3:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否
8.openEuler-24.03-LTS-SP1:否

原因说明：
1.master:正常修复
2.openEuler-20.03-LTS-SP4:正常修复
3.openEuler-22.03-LTS-SP1:正常修复
4.openEuler-22.03-LTS-SP3:正常修复
5.openEuler-24.03-LTS:正常修复
6.openEuler-24.03-LTS-Next:正常修复
7.openEuler-22.03-LTS-SP4:正常修复
8.openEuler-24.03-LTS-SP1:正常修复

@cherry530 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 分析项目 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.|
|已分析|2.openEulerScore|7.5|
|已分析|3.openEulerVector|AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H|
|已分析|4.受影响版本排查|master:受影响,openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-Next:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS-SP1:受影响|
|已分析|5.是否涉及abi变化|master:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS-SP1:否|
|已分析|6.原因说明|master:正常修复,openEuler-20.03-LTS-SP4:正常修复,openEuler-22.03-LTS-SP1:正常修复,openEuler-22.03-LTS-SP3:正常修复,openEuler-24.03-LTS:正常修复,openEuler-24.03-LTS-Next:正常修复,openEuler-22.03-LTS-SP4:正常修复,openEuler-24.03-LTS-SP1:正常修复|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

src-openEuler/python-django

内容风险标识

评论 (8)

src-openEuler/python-django .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-53907

评论 (8)

搜索帮助

src-openEuler/python-django