Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apply Django Security Patch v4.2.19 for Sumac #436

Open
10 tasks
magajh opened this issue Feb 7, 2025 · 0 comments
Open
10 tasks

Apply Django Security Patch v4.2.19 for Sumac #436

magajh opened this issue Feb 7, 2025 · 0 comments
Assignees
Labels
security Relates to improving to the security posture of the platform

Comments

@magajh
Copy link

magajh commented Feb 7, 2025

Apply latest Django patch https://docs.djangoproject.com/en/5.1/releases/4.2.19/
which contains latest security fix https://docs.djangoproject.com/en/5.1/releases/4.2.18/

Django 4.2.18 fixes a security issue with severity “moderate” in 4.2.17.
CVE-2024-56374: Potential denial-of-service vulnerability in IPv6 validation

Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address were vulnerable, as was the django.forms.GenericIPAddressField form field, which has now been updated to define a max_length of 39 characters.

The django.db.models.GenericIPAddressField model field was not affected.

Open edX services to upgrade (taken from https://openedx.atlassian.net/wiki/spaces/COMM/pages/4558782480/Sumac.master)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Relates to improving to the security posture of the platform
Projects
Status: No status
Development

No branches or pull requests

1 participant