Ubuntu 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-5204-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5204-1 advisory. Chris Bailey discovered that Django incorrectly handled evaluating submitted passwords. A remote attacker could possibly use this issue to...

CVE-2021-45115

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

CVE-2021-45115

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

CVE-2021-45115

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

aimmo (>=0.61.9b59, <=1.3.3), alcali (>=2018.3.1, <=2019.2.3) +97 more potentially affected by CVE-2021-45115 via django (>=2.2.0, <=2.2.25)

django PYPI version =2.2.0, =0.61.9b59, =2018.3.1, =0.3.62, =0.14.0, =4.7.0, =4.10.0, =5.2.1, =0.1.0, =4.15.0, =4.15.0, =1.0.1, =1.0.0, =0.0.30, =0.0.1, =0.0.5 and more Source cves: CVE-2021-45115 Source advisory: MEND:CVE-2021-45115...

CVE-2021-45115

CVE-2021-45115 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The issue is in UserAttributeSimilarityValidator, which incurs significant CPU overhead when validating passwords that are artificially large relative to comparison values, potentially enabling a denial-of-s...

ae-django-utils (0.3.1), apollo-sdk (>=0.2.0, <=0.2.11) +32 more potentially affected by CVE-2021-45115 via django (>=4.0.0a1, <=4.0.0)

django PYPI version =4.0.0a1, =0.2.0, =0.6.1, =2.16.1, =0.1.5, =1.0.7, =0.9.0, =0.4.0a2, =0.1.0, =0.1.1 and more Source cves: CVE-2021-45115 Source advisory: MEND:CVE-2021-45115...

admin-tool-button (>=1.0.1a0, <=1.0.5a0), aedttest (>=0.0.1.dev1, <=0.0.1) +99 more potentially affected by CVE-2021-45115 via django (>=3.2.0rc1, <=3.2.10)

django PYPI version =3.2.0rc1, =1.0.1a0, =0.0.1.dev1, =1.0.0, =0.0.1, =0.2.0, =1.0.0b6, =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =22.0.0.dev0, =0.1.0, =21.1.2, =0.0.1, =0.0.3 and more Source cves: CVE-2021-45115 Source advisory: MEND:CVE-2021-45115...

CVE-2021-45115

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

CVE-2021-45116

CVE-2021-45116 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The issue stems from the Django Template Language variable resolution logic; the dictsort template filter could disclose information or trigger an unintended method call when given a crafted key. Remediation...

CVE-2021-45116

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

CVE-2021-45116

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

CVE-2021-45116

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

CVE-2021-45116

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

CVE-2021-45116

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

CVE-2021-45452

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

CVE-2021-45452

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

CVE-2021-45452

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

aimmo (>=0.61.9b59, <=1.3.3), alcali (>=2018.3.1, <=2019.2.3) +97 more potentially affected by CVE-2021-45452 via django (>=2.2.0, <=2.2.25)

django PYPI version =2.2.0, =0.61.9b59, =2018.3.1, =0.3.62, =0.14.0, =4.7.0, =4.10.0, =5.2.1, =0.1.0, =4.15.0, =4.15.0, =1.0.1, =1.0.0, =0.0.30, =0.0.1, =0.0.5 and more Source cves: CVE-2021-45452 Source advisory: MEND:CVE-2021-45452...

apollo-sdk (>=0.2.0, <=0.2.11), audoma (>=0.6.1, <=0.6.10) +19 more potentially affected by CVE-2021-45452 via django (4.0.0)

django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.2.0, =0.6.1, =2.16.1, =1.0.7, =0.9.0, =0.9.0, =0.20.2, =0.70.0, =0.70.2 and more Source cves: CVE-2021-45452 Source advisory:...