Safety vulnerability ID: 44427
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Django 2.2.26, 3.2.11 and 4.0.1 include a fix for CVE-2021-45116: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
https://www.djangoproject.com/weblog/2022/jan/04/security-releases
Latest version: 5.1.3
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
===========================
*January 4, 2022*
Django 2.2.26 fixes one security issue with severity "medium" and two security
issues with severity "low" in 2.2.25.
CVE-2021-45115: Denial-of-service possibility in ``UserAttributeSimilarityValidator``
=====================================================================================
:class:`.UserAttributeSimilarityValidator` incurred significant overhead
evaluating submitted password that were artificially large in relative to the
comparison values. On the assumption that access to user registration was
unrestricted this provided a potential vector for a denial-of-service attack.
In order to mitigate this issue, relatively long values are now ignored by
``UserAttributeSimilarityValidator``.
This issue has severity "medium" according to the :ref:`Django security policy
<security-disclosure>`.
CVE-2021-45116: Potential information disclosure in ``dictsort`` template filter
================================================================================
Due to leveraging the Django Template Language's variable resolution logic, the
:tfilter:`dictsort` template filter was potentially vulnerable to information
disclosure or unintended method calls, if passed a suitably crafted key.
In order to avoid this possibility, ``dictsort`` now works with a restricted
resolution logic, that will not call methods, nor allow indexing on
dictionaries.
As a reminder, all untrusted user input should be validated before use.
This issue has severity "low" according to the :ref:`Django security policy
<security-disclosure>`.
CVE-2021-45452: Potential directory-traversal via ``Storage.save()``
====================================================================
``Storage.save()`` allowed directory-traversal if directly passed suitably
crafted file names.
This issue has severity "low" according to the :ref:`Django security policy
<security-disclosure>`.
===========================
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application