Python/django/4.1.5
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
https://pypi.org/project/django
BSD-3-Clause
AND
BSD
5 Security Vulnerabilities
Django Denial of service vulnerability in django.utils.encoding.uri_to_iri
- https://nvd.nist.gov/vuln/detail/CVE-2023-41164
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2023/sep/04/security-releases/
- https://github.com/django/django/commit/6f030b1149bd8fa4ba90452e77cb3edc095ce54e
- https://github.com/django/django/commit/9c51b4dcfa0cefcb48231f4d71cafa80821f87b9
- https://github.com/django/django/commit/ba00bc5ec6a7eff5e08be438f7b5b0e9574e8ff0
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-225.yaml
- https://github.com/advisories/GHSA-7h4p-27mh-hmrw
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
- https://security.netapp.com/advisory/ntap-20231214-0002/
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uritoiri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
Django Denial-of-service in django.utils.text.Truncator
- https://nvd.nist.gov/vuln/detail/CVE-2023-43665
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2023/oct/04/security-releases/
- https://github.com/django/django/commit/be9c27c4d18c2e6a5be8af4e53c0797440794473
- https://github.com/django/django/commit/c7b7024742250414e426ad49fb80db943e7ba4e8
- https://github.com/django/django/commit/ccdade1a0262537868d7ca64374de3d957ca50c5
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-226.yaml
- https://github.com/advisories/GHSA-h8gc-pgj2-vjm3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
Django has regular expression denial of service vulnerability in EmailValidator/URLValidator
- https://nvd.nist.gov/vuln/detail/CVE-2023-36053
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2023/jul/03/security-releases/
- https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582
- https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd
- https://github.com/django/django/commit/b7c5feb35a31799de6e582ad6a5a91a9de74e0f9
- https://github.com/django/django/commit/beb3f3d55940d9aa7198bf9d424ab74e873aec3d
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-100.yaml
- https://github.com/advisories/GHSA-jh3w-4vvf-mjgr
- https://lists.debian.org/debian-lts-announce/2023/07/msg00022.html
- https://www.debian.org/security/2023/dsa-5465
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS/
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator
and URLValidator
are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Django contains Uncontrolled Resource Consumption via cached header
- https://nvd.nist.gov/vuln/detail/CVE-2023-23969
- https://docs.djangoproject.com/en/4.1/releases/security/
- https://www.djangoproject.com/weblog/2023/feb/01/security-releases/
- https://lists.debian.org/debian-lts-announce/2023/02/msg00000.html
- https://github.com/advisories/GHSA-q2jf-h9jm-m7p4
- https://groups.google.com/forum/#!forum/django-announce
- https://security.netapp.com/advisory/ntap-20230302-0007/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
Django potential denial of service vulnerability in UsernameField on Windows
- https://nvd.nist.gov/vuln/detail/CVE-2023-46695
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2023/nov/01/security-releases/
- https://github.com/django/django/commit/048a9ebb6ea468426cb4e57c71572cbbd975517f
- https://github.com/django/django/commit/4965bfdde2e5a5c883685019e57d123a3368a75e
- https://github.com/django/django/commit/f9a7fb8466a7ba4857eaf930099b5258f3eafb2b
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-222.yaml
- https://github.com/advisories/GHSA-qmf9-6jqf-j8fq
- https://groups.google.com/forum/#%21forum/django-announce
- https://security.netapp.com/advisory/ntap-20231214-0001/
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
356 Other Versions
Version | License | Security | Released | |
---|---|---|---|---|
5.0.4 | BSD-3-Clause AND BSD | |||
5.0.3 | BSD-3-Clause AND BSD | |||
5.0.2 | BSD-3-Clause AND BSD | 1 | ||
5.0.1 | BSD-3-Clause AND BSD | 2 | ||
5.0 | BSD-3-Clause AND BSD | 2 | ||
4.2.11 | BSD-3-Clause AND BSD | |||
4.2.10 | BSD-3-Clause AND BSD | 1 | ||
4.2.9 | BSD-3-Clause AND BSD | 2 | ||
4.2.8 | BSD-3-Clause AND BSD | 2 | ||
4.2.7 | BSD-3-Clause AND BSD | 2 | ||
4.2.6 | BSD-3-Clause AND BSD | 3 | ||
4.2.5 | BSD-3-Clause AND BSD | 4 | ||
4.2.4 | BSD-3-Clause AND BSD | 5 | ||
4.2.3 | BSD-3-Clause AND BSD | 5 | ||
4.2.2 | BSD-3-Clause AND BSD | 6 | ||
4.2.1 | BSD-3-Clause AND BSD | 6 | ||
4.2 | BSD-3-Clause AND BSD | 6 | ||
4.1.13 | BSD-3-Clause AND BSD | |||
4.1.12 | BSD-3-Clause AND BSD | 1 | ||
4.1.11 | BSD-3-Clause AND BSD | 2 | ||
4.1.10 | BSD-3-Clause AND BSD | 3 | ||
4.1.9 | BSD-3-Clause AND BSD | 4 | ||
4.1.8 | BSD-3-Clause AND BSD | 4 | ||
4.1.7 | BSD-3-Clause AND BSD | 4 | ||
4.1.6 | BSD-3-Clause AND BSD | 4 | ||
4.1.5 | BSD-3-Clause AND BSD | 5 | ||
4.1.4 | BSD-3-Clause AND BSD | 5 | ||
4.1.3 | BSD-3-Clause AND BSD | 5 | ||
4.1.2 | BSD-3-Clause AND BSD | 5 | ||
4.1.1 | BSD-3-Clause AND BSD | 6 | ||
4.1 | BSD-3-Clause AND BSD | 6 | ||
4.0.10 | BSD-3-Clause AND BSD | 1 | ||
4.0.9 | BSD-3-Clause AND BSD | 1 | ||
4.0.8 | BSD-3-Clause AND BSD | 2 | ||
4.0.7 | BSD-3-Clause AND BSD | 3 | ||
4.0.6 | BSD-3-Clause AND BSD | 3 | 2022-07-04 - 07:57 | almost 2 years |
4.0.5 | BSD-3-Clause AND BSD | 4 | 2022-06-01 - 12:22 | almost 2 years |
4.0.4 | BSD-3-Clause AND BSD | 4 | 2022-04-11 - 07:53 | about 2 years |
4.0.3 | BSD-3-Clause AND BSD | 4 | 2022-03-01 - 08:47 | about 2 years |
4.0.2 | BSD-3-Clause AND BSD | 4 | 2022-02-01 - 07:56 | about 2 years |
4.0.1 | BSD-3-Clause AND BSD | 6 | 2022-01-04 - 09:53 | over 2 years |
4.0 | BSD-3-Clause AND BSD | 6 | 2021-12-07 - 09:19 | over 2 years |
3.2.25 | BSD-3-Clause AND BSD | |||
3.2.24 | BSD-3-Clause AND BSD | 1 | ||
3.2.23 | BSD-3-Clause AND BSD | 2 | ||
3.2.22 | BSD-3-Clause AND BSD | 3 | ||
3.2.21 | BSD-3-Clause AND BSD | 4 | ||
3.2.20 | BSD-3-Clause AND BSD | 5 | ||
3.2.19 | BSD-3-Clause AND BSD | 6 | ||
3.2.18 | BSD-3-Clause AND BSD | 6 | ||
3.2.17 | BSD-3-Clause AND BSD | 6 | ||
3.2.16 | BSD-3-Clause AND BSD | 7 | ||
3.2.15 | BSD-3-Clause AND BSD | 8 | ||
3.2.14 | BSD-3-Clause AND BSD | 8 | 2022-07-04 - 07:57 | almost 2 years |
3.2.13 | BSD-3-Clause AND BSD | 9 | 2022-04-11 - 07:52 | about 2 years |
3.2.12 | BSD-3-Clause AND BSD | 9 | 2022-02-01 - 07:56 | about 2 years |
3.2.11 | BSD-3-Clause AND BSD | 11 | 2022-01-04 - 09:53 | over 2 years |
3.2.10 | BSD-3-Clause AND BSD | 11 | 2021-12-07 - 07:34 | over 2 years |
3.2.9 | BSD-3-Clause AND BSD | 11 | 2021-11-01 - 09:31 | over 2 years |
3.2.8 | BSD-3-Clause AND BSD | 11 | 2021-10-05 - 07:46 | over 2 years |
3.2.7 | BSD-3-Clause AND BSD | 11 | 2021-09-01 - 05:57 | over 2 years |
3.2.6 | BSD-3-Clause AND BSD | 11 | 2021-08-02 - 06:28 | over 2 years |
3.2.5 | BSD-3-Clause AND BSD | 11 | 2021-07-01 - 07:40 | almost 3 years |
3.2.4 | BSD-3-Clause AND BSD | 11 | 2021-06-02 - 08:54 | almost 3 years |
3.2.3 | BSD-3-Clause AND BSD | 13 | 2021-05-13 - 07:36 | almost 3 years |
3.2.2 | BSD-3-Clause AND BSD | 13 | 2021-05-06 - 07:40 | almost 3 years |
3.2.1 | BSD-3-Clause AND BSD | 13 | 2021-05-04 - 08:47 | almost 3 years |
3.2 | BSD-3-Clause AND BSD | 13 | 2021-04-06 - 09:33 | about 3 years |
3.1.14 | BSD-3-Clause AND BSD | 1 | 2021-12-07 - 07:34 | over 2 years |
3.1.13 | BSD-3-Clause AND BSD | 1 | 2021-07-01 - 07:39 | almost 3 years |
3.1.12 | BSD-3-Clause AND BSD | 1 | 2021-06-02 - 08:53 | almost 3 years |
3.1.11 | BSD-3-Clause AND BSD | 3 | 2021-05-13 - 07:36 | almost 3 years |
3.1.10 | BSD-3-Clause AND BSD | 3 | 2021-05-06 - 07:40 | almost 3 years |
3.1.9 | BSD-3-Clause AND BSD | 3 | 2021-05-04 - 08:47 | almost 3 years |
3.1.8 | BSD-3-Clause AND BSD | 3 | 2021-04-06 - 07:34 | about 3 years |
3.1.7 | BSD-3-Clause AND BSD | 3 | 2021-02-19 - 09:08 | about 3 years |
3.1.6 | BSD-3-Clause AND BSD | 3 | 2021-02-01 - 09:28 | about 3 years |
3.1.5 | BSD-3-Clause AND BSD | 4 | 2021-01-04 - 07:54 | over 3 years |
3.1.4 | BSD-3-Clause AND BSD | 4 | 2020-12-01 - 06:03 | over 3 years |
3.1.3 | BSD-3-Clause AND BSD | 4 | 2020-11-02 - 08:12 | over 3 years |
3.1.2 | BSD-3-Clause AND BSD | 4 | 2020-10-01 - 05:38 | over 3 years |
3.1.1 | BSD-3-Clause AND BSD | 4 | 2020-09-01 - 09:14 | over 3 years |
3.1 | BSD-3-Clause AND BSD | 6 | 2020-08-04 - 08:07 | over 3 years |
3.0.14 | BSD | 3 | 2021-04-06 - 07:34 | about 3 years |
3.0.13 | BSD | 3 | 2021-02-19 - 09:08 | about 3 years |
3.0.12 | BSD | 3 | 2021-02-01 - 09:28 | about 3 years |
3.0.11 | BSD | 4 | 2020-11-02 - 08:12 | over 3 years |
3.0.10 | BSD | 4 | 2020-09-01 - 09:14 | over 3 years |
3.0.9 | BSD | 6 | 2020-08-03 - 07:23 | over 3 years |
3.0.8 | BSD | 6 | 2020-07-01 - 04:49 | almost 4 years |
3.0.7 | BSD | 6 | 2020-06-03 - 09:36 | almost 4 years |
3.0.6 | BSD | 8 | 2020-05-04 - 05:26 | almost 4 years |
3.0.5 | BSD | 8 | 2020-04-01 - 07:59 | about 4 years |
3.0.4 | BSD | 8 | 2020-03-04 - 09:31 | about 4 years |
3.0.3 | BSD | 9 | 2020-02-03 - 09:50 | about 4 years |
3.0.2 | BSD | 10 | 2020-01-02 - 07:22 | over 4 years |
3.0.1 | BSD | 10 | 2019-12-18 - 08:59 | over 4 years |
3.0 | BSD | 11 | 2019-12-02 - 11:13 | over 4 years |
2.2.28 | BSD | 1 | 2022-04-11 - 07:52 | about 2 years |
2.2.27 | BSD | 1 | 2022-02-01 - 07:56 | about 2 years |