CVE-2020-15225

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-15225
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15225.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15225
Aliases
Related
Published
2021-04-29T21:15:08Z
Modified
2025-01-15T01:43:03.462660Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a MaxValueValidator with a a default limit_value of 1e50 to the form field used by NumberFilter instances. In addition, NumberFilter implements the new get_max_validator() which should return a configured validator instance to customise the limit, or else None to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.

References

Affected packages

Debian:11 / django-filter

Package

Name
django-filter
Purl
pkg:deb/debian/django-filter?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / django-filter

Package

Name
django-filter
Purl
pkg:deb/debian/django-filter?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / django-filter

Package

Name
django-filter
Purl
pkg:deb/debian/django-filter?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/carltongibson/django-filter

Affected ranges

Type
GIT
Repo
https://github.com/carltongibson/django-filter
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
340cf7a23a2b3dcd7183f6a0d6c383e85b130d2b
Fixed
340cf7a23a2b3dcd7183f6a0d6c383e85b130d2b

Affected versions

0.*

0.1.0
0.11.0
0.12.0
0.14.0
0.15.0
0.15.1
0.15.2
0.15.3
0.2.0
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.9.0
0.9.1

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0

2.*

2.0.0
2.1.0
2.2.0
2.3.0

v0.*

v0.10.0
v0.13
v0.6
v0.6a1
v0.7
v0.8
v0.9.2