Python/django/2.2.3
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
https://pypi.org/project/django
BSD
18 Security Vulnerabilities
XSS in Django
- https://nvd.nist.gov/vuln/detail/CVE-2020-13596
- https://github.com/advisories/GHSA-2m34-jcjv-45xf
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://groups.google.com/forum/#!msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ
- https://www.djangoproject.com/weblog/2020/jun/03/security-releases/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
- https://security.netapp.com/advisory/ntap-20200611-0002/
- https://usn.ubuntu.com/4381-1/
- https://usn.ubuntu.com/4381-2/
- https://www.debian.org/security/2020/dsa-4705
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://github.com/django/django/commit/1f2dd37f6fcefdd10ed44cb233b2e62b520afb38
- https://github.com/django/django/commit/6d61860b22875f358fac83d903dc629897934815
- https://docs.djangoproject.com/en/3.0/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ
- https://security.netapp.com/advisory/ntap-20200611-0002
- https://usn.ubuntu.com/4381-1
- https://usn.ubuntu.com/4381-2
- https://www.djangoproject.com/weblog/2020/jun/03/security-releases
An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
SQL injection in Django
- https://nvd.nist.gov/vuln/detail/CVE-2020-9402
- https://github.com/advisories/GHSA-3gh2-xw74-jmcw
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/fLUh_pOaKrY
- https://usn.ubuntu.com/4296-1/
- https://www.djangoproject.com/weblog/2020/mar/04/security-releases/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20200327-0004/
- https://www.debian.org/security/2020/dsa-4705
- https://lists.debian.org/debian-lts-announce/2022/05/msg00035.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UZMN2NKAGTFE3YKMNM2JVJG7R2W7LLHY/
- https://github.com/django/django/commit/6695d29b1c1ce979725816295a26ecc64ae0e927
- https://docs.djangoproject.com/en/3.0/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UZMN2NKAGTFE3YKMNM2JVJG7R2W7LLHY
- https://security.netapp.com/advisory/ntap-20200327-0004
- https://usn.ubuntu.com/4296-1
- https://www.djangoproject.com/weblog/2020/mar/04/security-releases
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
Path Traversal in Django
- https://nvd.nist.gov/vuln/detail/CVE-2021-33203
- https://github.com/advisories/GHSA-68w8-qjq3-2gfm
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2021/jun/02/security-releases/
- https://security.netapp.com/advisory/ntap-20210727-0004/
- https://github.com/django/django/commit/053cc9534d174dc89daba36724ed2dcb36755b90
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://github.com/django/django/commit/20c67a0693c4ede2b09af02574823485e82e4c8f
- https://github.com/django/django/commit/dfaba12cda060b8b292ae1d271b44bf810b1c5b9
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
Infinite Loop in Django
- https://nvd.nist.gov/vuln/detail/CVE-2022-23833
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
- https://github.com/advisories/GHSA-6cw3-g6wv-c2xv
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20220221-0003/
- https://www.debian.org/security/2022/dsa-5254
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
SQL Injection in Django
- https://nvd.nist.gov/vuln/detail/CVE-2019-14234
- https://github.com/advisories/GHSA-6r97-cj55-9hrq
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- https://github.com/django/django/commit/4f5b58f5cd3c57fee9972ab074f8dc6895d8f387
- https://github.com/django/django/commit/ed682a24fca774818542757651bfba576c3fc3ef
- https://github.com/django/django/commit/f74b3ae3628c26e1b4f8db3d13a91d52a833a975
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of OR 1=1
in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
Cross-site Scripting in Django
- https://nvd.nist.gov/vuln/detail/CVE-2022-22818
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
- https://github.com/advisories/GHSA-95rw-fx8r-36v6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20220221-0003/
- https://www.debian.org/security/2022/dsa-5254
- https://github.com/django/django/commit/01422046065d2b51f8f613409cad2c81b39487e5
- https://github.com/django/django/commit/1a1e8278c46418bde24c86a65443b0674bae65e2
- https://github.com/django/django/commit/c27a7eb9f40b64990398978152e62b6ff839c2e6
- https://docs.djangoproject.com/en/4.0/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
- https://security.netapp.com/advisory/ntap-20220221-0003
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases
The {% debug %}
template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
Django Denial-of-service in django.utils.text.Truncator
- https://nvd.nist.gov/vuln/detail/CVE-2019-14232
- https://github.com/advisories/GHSA-c4qh-4vgv-qc6g
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/
- https://seclists.org/bugtraq/2019/Aug/15
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://www.debian.org/security/2019/dsa-4498
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
- https://github.com/pypa/advisory-db/tree/main/vulns/django/PYSEC-2019-11.yaml
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ/
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW/
- https://www.openwall.com/lists/oss-security/2023/10/04/6
- http://www.openwall.com/lists/oss-security/2023/10/04/6
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW
- https://security.netapp.com/advisory/ntap-20190828-0002
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases
- http://www.openwall.com/lists/oss-security/2024/03/04/1
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator
's chars()
and words()
methods were passed the html=True
argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars()
and words()
methods are used to implement the truncatechars_htm
l and truncatewords_html
template filters, which were thus vulnerable.
Django Incorrect Default Permissions
- https://nvd.nist.gov/vuln/detail/CVE-2020-24584
- https://github.com/advisories/GHSA-fr28-569j-53c4
- https://github.com/django/django/commit/1853724acaf17ed7414d54c7d2b5563a25025a71
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/Gdqn58RqIDM
- https://groups.google.com/forum/#!topic/django-announce/zFCMdgUnutU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI/
- https://security.netapp.com/advisory/ntap-20200918-0004/
- https://usn.ubuntu.com/4479-1/
- https://www.djangoproject.com/weblog/2020/sep/01/security-releases/
- https://www.openwall.com/lists/oss-security/2020/09/01/2
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e81915b
- https://github.com/django/django/commit/a3aebfdc8153dc230686b6d2454ccd32ed4c9e6f
- https://github.com/django/django/commit/cdb367c92a0ba72ddc0cbd13ff42b0e6df709554
- https://docs.djangoproject.com/en/dev/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI
- https://security.netapp.com/advisory/ntap-20200918-0004
- https://usn.ubuntu.com/4479-1
- https://www.djangoproject.com/weblog/2020/sep/01/security-releases
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.
Django Directory Traversal via archive.extract
- https://nvd.nist.gov/vuln/detail/CVE-2021-3281
- https://github.com/advisories/GHSA-fvgf-6h6h-3322
- https://github.com/django/django/commit/05413afa8c18cdb978fcdf470e09f7a12b234a23
- https://docs.djangoproject.com/en/3.1/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
- https://security.netapp.com/advisory/ntap-20210226-0004/
- https://www.djangoproject.com/weblog/2021/feb/01/security-releases/
- https://docs.djangoproject.com/en/3.1/releases/3.0.12/
- https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef435f624
- https://github.com/django/django/commit/21e7622dec1f8612c85c2fc37fe8efbfd3311e37
- https://github.com/django/django/commit/52e409ed17287e9aabda847b6afe58be2fa9f86a
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by startapp --template
and startproject --template
) allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Django Denial-of-service in strip_tags()
- https://nvd.nist.gov/vuln/detail/CVE-2019-14233
- https://github.com/advisories/GHSA-h5jv-4p7w-64jg
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/
- https://seclists.org/bugtraq/2019/Aug/15
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://www.debian.org/security/2019/dsa-4498
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
SQL injection in Django
- https://nvd.nist.gov/vuln/detail/CVE-2020-7471
- https://github.com/advisories/GHSA-hmr4-m2h5-33qx
- https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/X45S86X5bZI
- https://www.djangoproject.com/weblog/2020/feb/03/security-releases/
- https://www.openwall.com/lists/oss-security/2020/02/03/1
- http://www.openwall.com/lists/oss-security/2020/02/03/1
- https://usn.ubuntu.com/4264-1/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
- https://seclists.org/bugtraq/2020/Feb/30
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20200221-0006/
- https://www.debian.org/security/2020/dsa-4629
- https://github.com/django/django/commit/001b0634cd309e372edb6d7d95d083d02b8e37bd
- https://github.com/django/django/commit/505826b469b16ab36693360da9e11fd13213421b
- https://github.com/django/django/commit/c67a368c16e4680b324b4f385398d638db4d8147
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
Django allows unintended model editing
- https://nvd.nist.gov/vuln/detail/CVE-2019-19118
- https://github.com/advisories/GHSA-hvmf-r92r-27hr
- https://github.com/django/django/commit/103ebe2b5ff1b2614b85a52c239f471904d26244
- https://github.com/django/django/commit/36f580a17f0b3cb087deadf3b65eea024f479c21
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/GjGqDvtNmWQ
- https://www.djangoproject.com/weblog/2019/dec/02/security-releases/
- http://www.openwall.com/lists/oss-security/2019/12/02/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5/
- https://security.netapp.com/advisory/ntap-20191217-0003/
- https://security.gentoo.org/glsa/202004-17
- https://docs.djangoproject.com/en/dev/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5
- https://security.netapp.com/advisory/ntap-20191217-0003
- https://www.djangoproject.com/weblog/2019/dec/02/security-releases
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
Django Incorrect Default Permissions
- https://nvd.nist.gov/vuln/detail/CVE-2020-24583
- https://github.com/advisories/GHSA-m6gj-h9gm-gw44
- https://github.com/django/django/commit/8d7271578d7b153435b40fe40236ebec43cbf1b9
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/Gdqn58RqIDM
- https://groups.google.com/forum/#!topic/django-announce/zFCMdgUnutU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI/
- https://security.netapp.com/advisory/ntap-20200918-0004/
- https://usn.ubuntu.com/4479-1/
- https://www.djangoproject.com/weblog/2020/sep/01/security-releases/
- https://www.openwall.com/lists/oss-security/2020/09/01/2
- https://www.oracle.com/security-alerts/cpujan2021.html
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILEUPLOADDIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.
Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
- https://nvd.nist.gov/vuln/detail/CVE-2021-33571
- https://github.com/advisories/GHSA-p99v-5w3c-jqq9
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo
- https://www.djangoproject.com/weblog/2021/jun/02/security-releases/
- https://security.netapp.com/advisory/ntap-20210727-0004/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e
- https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
- https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validateipv4address and validateipv46address are unaffected with Python 3.9.5+..) .
Uncontrolled Recursion in Django
- https://nvd.nist.gov/vuln/detail/CVE-2019-14235
- https://github.com/advisories/GHSA-v9qg-3j8p-r63v
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/
- https://seclists.org/bugtraq/2019/Aug/15
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://www.debian.org/security/2019/dsa-4498
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uritoiri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
Django Potential account hijack via password reset form
- https://nvd.nist.gov/vuln/detail/CVE-2019-19844
- https://github.com/advisories/GHSA-vfq6-hq5r-27r6
- https://github.com/django/django/commit/5b1fbcef7a8bec991ebe7b2a18b5d5a95d72cb70
- https://github.com/django/django/commit/f4cff43bf921fcea6a29b726eb66767f67753fa2
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#!topic/django-announce/3oaB2rVH3a0
- https://seclists.org/bugtraq/2020/Jan/9
- https://security.netapp.com/advisory/ntap-20200110-0003/
- https://usn.ubuntu.com/4224-1/
- https://www.debian.org/security/2020/dsa-4598
- https://www.djangoproject.com/weblog/2019/dec/18/security-releases/
- http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/
- https://security.gentoo.org/glsa/202004-17
- https://github.com/django/django/commit/302a4ff1e8b1c798aab97673909c7a3dfda42c26
- https://github.com/django/django/commit/4d334bea06cac63dc1272abcec545b85136cca0e
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Data leakage via cache key collision in Django
- https://nvd.nist.gov/vuln/detail/CVE-2020-13254
- https://github.com/advisories/GHSA-wpjr-j57x-wxfw
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://groups.google.com/d/msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ
- https://www.djangoproject.com/weblog/2020/jun/03/security-releases/
- https://lists.debian.org/debian-lts-announce/2020/06/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
- https://security.netapp.com/advisory/ntap-20200611-0002/
- https://usn.ubuntu.com/4381-1/
- https://usn.ubuntu.com/4381-2/
- https://www.debian.org/security/2020/dsa-4705
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://github.com/django/django/commit/07e59caa02831c4569bbebb9eb773bdd9cb4b206
- https://github.com/django/django/commit/84b2da5552e100ae3294f564f6c862fef8d0e693
An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
Django denial-of-service attack in the intcomma template filter
- https://nvd.nist.gov/vuln/detail/CVE-2024-24680
- https://docs.djangoproject.com/en/5.0/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://www.djangoproject.com/weblog/2024/feb/06/security-releases/
- https://github.com/django/django/commit/16a8fe18a3b81250f4fa57e3f93f0599dc4895bc
- https://github.com/django/django/commit/55519d6cf8998fe4c8f5c8abffc2b10a7c3d14e9
- https://github.com/django/django/commit/572ea07e84b38ea8de0551f4b4eda685d91d09d2
- https://github.com/django/django/commit/c1171ffbd570db90ca206c30f8e2b9f691243820
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-28.yaml
- https://github.com/advisories/GHSA-xxj9-f6rv-m3x4
- https://docs.djangoproject.com/en/5.0/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
- https://www.djangoproject.com/weblog/2024/feb/06/security-releases
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.
358 Other Versions
Version | License | Security | Released | |
---|---|---|---|---|
5.0.5 | BSD-3-Clause AND BSD | |||
5.0.4 | BSD-3-Clause AND BSD | |||
5.0.3 | BSD-3-Clause AND BSD | |||
5.0.2 | BSD-3-Clause AND BSD | 1 | ||
5.0.1 | BSD-3-Clause AND BSD | 2 | ||
5.0 | BSD-3-Clause AND BSD | 2 | ||
4.2.12 | BSD-3-Clause AND BSD | |||
4.2.11 | BSD-3-Clause AND BSD | |||
4.2.10 | BSD-3-Clause AND BSD | 1 | ||
4.2.9 | BSD-3-Clause AND BSD | 2 | ||
4.2.8 | BSD-3-Clause AND BSD | 2 | ||
4.2.7 | BSD-3-Clause AND BSD | 2 | ||
4.2.6 | BSD-3-Clause AND BSD | 3 | ||
4.2.5 | BSD-3-Clause AND BSD | 4 | ||
4.2.4 | BSD-3-Clause AND BSD | 5 | ||
4.2.3 | BSD-3-Clause AND BSD | 5 | ||
4.2.2 | BSD-3-Clause AND BSD | 6 | ||
4.2.1 | BSD-3-Clause AND BSD | 6 | ||
4.2 | BSD-3-Clause AND BSD | 6 | ||
4.1.13 | BSD-3-Clause AND BSD | |||
4.1.12 | BSD-3-Clause AND BSD | 1 | ||
4.1.11 | BSD-3-Clause AND BSD | 2 | ||
4.1.10 | BSD-3-Clause AND BSD | 3 | ||
4.1.9 | BSD-3-Clause AND BSD | 4 | ||
4.1.8 | BSD-3-Clause AND BSD | 4 | ||
4.1.7 | BSD-3-Clause AND BSD | 4 | ||
4.1.6 | BSD-3-Clause AND BSD | 4 | ||
4.1.5 | BSD-3-Clause AND BSD | 5 | ||
4.1.4 | BSD-3-Clause AND BSD | 5 | ||
4.1.3 | BSD-3-Clause AND BSD | 5 | ||
4.1.2 | BSD-3-Clause AND BSD | 5 | ||
4.1.1 | BSD-3-Clause AND BSD | 6 | ||
4.1 | BSD-3-Clause AND BSD | 6 | ||
4.0.10 | BSD-3-Clause AND BSD | 1 | ||
4.0.9 | BSD-3-Clause AND BSD | 1 | ||
4.0.8 | BSD-3-Clause AND BSD | 2 | ||
4.0.7 | BSD-3-Clause AND BSD | 3 | ||
4.0.6 | BSD-3-Clause AND BSD | 3 | 2022-07-04 - 07:57 | almost 2 years |
4.0.5 | BSD-3-Clause AND BSD | 4 | 2022-06-01 - 12:22 | almost 2 years |
4.0.4 | BSD-3-Clause AND BSD | 4 | 2022-04-11 - 07:53 | about 2 years |
4.0.3 | BSD-3-Clause AND BSD | 4 | 2022-03-01 - 08:47 | about 2 years |
4.0.2 | BSD-3-Clause AND BSD | 4 | 2022-02-01 - 07:56 | over 2 years |
4.0.1 | BSD-3-Clause AND BSD | 6 | 2022-01-04 - 09:53 | over 2 years |
4.0 | BSD-3-Clause AND BSD | 6 | 2021-12-07 - 09:19 | over 2 years |
3.2.25 | BSD-3-Clause AND BSD | |||
3.2.24 | BSD-3-Clause AND BSD | 1 | ||
3.2.23 | BSD-3-Clause AND BSD | 2 | ||
3.2.22 | BSD-3-Clause AND BSD | 3 | ||
3.2.21 | BSD-3-Clause AND BSD | 4 | ||
3.2.20 | BSD-3-Clause AND BSD | 5 | ||
3.2.19 | BSD-3-Clause AND BSD | 6 | ||
3.2.18 | BSD-3-Clause AND BSD | 6 | ||
3.2.17 | BSD-3-Clause AND BSD | 6 | ||
3.2.16 | BSD-3-Clause AND BSD | 7 | ||
3.2.15 | BSD-3-Clause AND BSD | 8 | ||
3.2.14 | BSD-3-Clause AND BSD | 8 | 2022-07-04 - 07:57 | almost 2 years |
3.2.13 | BSD-3-Clause AND BSD | 9 | 2022-04-11 - 07:52 | about 2 years |
3.2.12 | BSD-3-Clause AND BSD | 9 | 2022-02-01 - 07:56 | over 2 years |
3.2.11 | BSD-3-Clause AND BSD | 11 | 2022-01-04 - 09:53 | over 2 years |
3.2.10 | BSD-3-Clause AND BSD | 11 | 2021-12-07 - 07:34 | over 2 years |
3.2.9 | BSD-3-Clause AND BSD | 11 | 2021-11-01 - 09:31 | over 2 years |
3.2.8 | BSD-3-Clause AND BSD | 11 | 2021-10-05 - 07:46 | over 2 years |
3.2.7 | BSD-3-Clause AND BSD | 11 | 2021-09-01 - 05:57 | over 2 years |
3.2.6 | BSD-3-Clause AND BSD | 11 | 2021-08-02 - 06:28 | almost 3 years |
3.2.5 | BSD-3-Clause AND BSD | 11 | 2021-07-01 - 07:40 | almost 3 years |
3.2.4 | BSD-3-Clause AND BSD | 11 | 2021-06-02 - 08:54 | almost 3 years |
3.2.3 | BSD-3-Clause AND BSD | 13 | 2021-05-13 - 07:36 | almost 3 years |
3.2.2 | BSD-3-Clause AND BSD | 13 | 2021-05-06 - 07:40 | about 3 years |
3.2.1 | BSD-3-Clause AND BSD | 13 | 2021-05-04 - 08:47 | about 3 years |
3.2 | BSD-3-Clause AND BSD | 13 | 2021-04-06 - 09:33 | about 3 years |
3.1.14 | BSD-3-Clause AND BSD | 1 | 2021-12-07 - 07:34 | over 2 years |
3.1.13 | BSD-3-Clause AND BSD | 1 | 2021-07-01 - 07:39 | almost 3 years |
3.1.12 | BSD-3-Clause AND BSD | 1 | 2021-06-02 - 08:53 | almost 3 years |
3.1.11 | BSD-3-Clause AND BSD | 3 | 2021-05-13 - 07:36 | almost 3 years |
3.1.10 | BSD-3-Clause AND BSD | 3 | 2021-05-06 - 07:40 | about 3 years |
3.1.9 | BSD-3-Clause AND BSD | 3 | 2021-05-04 - 08:47 | about 3 years |
3.1.8 | BSD-3-Clause AND BSD | 3 | 2021-04-06 - 07:34 | about 3 years |
3.1.7 | BSD-3-Clause AND BSD | 3 | 2021-02-19 - 09:08 | about 3 years |
3.1.6 | BSD-3-Clause AND BSD | 3 | 2021-02-01 - 09:28 | over 3 years |
3.1.5 | BSD-3-Clause AND BSD | 4 | 2021-01-04 - 07:54 | over 3 years |
3.1.4 | BSD-3-Clause AND BSD | 4 | 2020-12-01 - 06:03 | over 3 years |
3.1.3 | BSD-3-Clause AND BSD | 4 | 2020-11-02 - 08:12 | over 3 years |
3.1.2 | BSD-3-Clause AND BSD | 4 | 2020-10-01 - 05:38 | over 3 years |
3.1.1 | BSD-3-Clause AND BSD | 4 | 2020-09-01 - 09:14 | over 3 years |
3.1 | BSD-3-Clause AND BSD | 6 | 2020-08-04 - 08:07 | almost 4 years |
3.0.14 | BSD | 3 | 2021-04-06 - 07:34 | about 3 years |
3.0.13 | BSD | 3 | 2021-02-19 - 09:08 | about 3 years |
3.0.12 | BSD | 3 | 2021-02-01 - 09:28 | over 3 years |
3.0.11 | BSD | 4 | 2020-11-02 - 08:12 | over 3 years |
3.0.10 | BSD | 4 | 2020-09-01 - 09:14 | over 3 years |
3.0.9 | BSD | 6 | 2020-08-03 - 07:23 | almost 4 years |
3.0.8 | BSD | 6 | 2020-07-01 - 04:49 | almost 4 years |
3.0.7 | BSD | 6 | 2020-06-03 - 09:36 | almost 4 years |
3.0.6 | BSD | 8 | 2020-05-04 - 05:26 | about 4 years |
3.0.5 | BSD | 8 | 2020-04-01 - 07:59 | about 4 years |
3.0.4 | BSD | 8 | 2020-03-04 - 09:31 | about 4 years |
3.0.3 | BSD | 9 | 2020-02-03 - 09:50 | over 4 years |
3.0.2 | BSD | 10 | 2020-01-02 - 07:22 | over 4 years |
3.0.1 | BSD | 10 | 2019-12-18 - 08:59 | over 4 years |
3.0 | BSD | 11 | 2019-12-02 - 11:13 | over 4 years |