PYSEC-2022-2

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

PYSEC-2022-1

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

aimmo (>=0.61.9b59, <=1.3.3), alcali (>=2018.3.1, <=2019.2.3) +97 more potentially affected by CVE-2021-45452 via django (>=2.2.0, <=2.2.25)

django PYPI version =2.2.0, =0.61.9b59, =2018.3.1, =0.3.62, =0.14.0, =4.7.0, =4.10.0, =5.2.1, =0.1.0, =4.15.0, =4.15.0, =1.0.1, =1.0.0, =0.0.30, =0.0.1, =0.0.5 and more Source cves: CVE-2021-45452 Source advisory: OSV:PYSEC-2022-3...

PYSEC-2022-1

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

aimmo (>=0.61.9b59, <=1.3.3), alcali (>=2018.3.1, <=2019.2.3) +97 more potentially affected by CVE-2021-45115 via django (>=2.2.0, <=2.2.25)

django PYPI version =2.2.0, =0.61.9b59, =2018.3.1, =0.3.62, =0.14.0, =4.7.0, =4.10.0, =5.2.1, =0.1.0, =4.15.0, =4.15.0, =1.0.1, =1.0.0, =0.0.30, =0.0.1, =0.0.5 and more Source cves: CVE-2021-45115 Source advisory: OSV:PYSEC-2022-1...

Design/Logic Flaw

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

PYSEC-2022-3

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

Information disclosure

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

PYSEC-2022-2

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

apollo-sdk (>=0.2.0, <=0.2.11), audoma (>=0.6.1, <=0.6.10) +19 more potentially affected by CVE-2021-45115 via django (4.0.0)

django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.2.0, =0.6.1, =2.16.1, =1.0.7, =0.9.0, =0.9.0, =0.20.2, =0.70.0, =0.70.2 and more Source cves: CVE-2021-45115 Source advisory:...

apollo-sdk (>=0.2.0, <=0.2.11), audoma (>=0.6.1, <=0.6.10) +19 more potentially affected by CVE-2021-45452 via django (4.0.0)

django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.2.0, =0.6.1, =2.16.1, =1.0.7, =0.9.0, =0.9.0, =0.20.2, =0.70.0, =0.70.2 and more Source cves: CVE-2021-45452 Source advisory:...

admin-tool-button (>=1.0.1a0, <=1.0.5a0), aedttest (>=0.0.1.dev1, <=0.0.1) +98 more potentially affected by CVE-2021-45452 via django (>=3.2.0, <=3.2.10)

django PYPI version =3.2.0, =1.0.1a0, =0.0.1.dev1, =1.0.0, =0.0.1, =0.2.0, =1.0.0b6, =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =22.0.0.dev0, =0.1.0, =21.1.2, =0.0.1, =0.0.3 and more Source cves: CVE-2021-45452 Source advisory: OSV:PYSEC-2022-3...

PYSEC-2022-3

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

Directory traversal

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

FreeBSD : Django -- multiple vulnerabilities (d3e023fb-6e88-11ec-b948-080027240888)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d3e023fb-6e88-11ec-b948-080027240888 advisory. - An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1...

Ubuntu 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-5204-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5204-1 advisory. Chris Bailey discovered that Django incorrectly handled evaluating submitted passwords. A remote attacker could possibly use this issue to...

CVE-2021-45115

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

CVE-2021-45115

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

aimmo (>=0.61.9b59, <=1.3.3), alcali (>=2018.3.1, <=2019.2.3) +97 more potentially affected by CVE-2021-45115 via django (>=2.2.0, <=2.2.25)

django PYPI version =2.2.0, =0.61.9b59, =2018.3.1, =0.3.62, =0.14.0, =4.7.0, =4.10.0, =5.2.1, =0.1.0, =4.15.0, =4.15.0, =1.0.1, =1.0.0, =0.0.30, =0.0.1, =0.0.5 and more Source cves: CVE-2021-45115 Source advisory: MEND:CVE-2021-45115...

CVE-2021-45115

CVE-2021-45115 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The issue is in UserAttributeSimilarityValidator, which incurs significant CPU overhead when validating passwords that are artificially large relative to comparison values, potentially enabling a denial-of-s...