GHSA-8c5j-9r9f-c6w8

Source

https://github.com/advisories/GHSA-8c5j-9r9f-c6w8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8c5j-9r9f-c6w8/GHSA-8c5j-9r9f-c6w8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8c5j-9r9f-c6w8

Aliases

Published

2022-01-12T19:21:10Z

Modified

2024-09-20T12:32:54.884966Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Information disclosure in Django

Details

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.

Database specific

{
    "nvd_published_at": "2022-01-05T00:15:00Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-12T19:18:36Z"
}

References

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2

Fixed

2.2.26

Affected versions

2.*

2.2

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2.10

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

2.2.18

2.2.19

2.2.20

2.2.21

2.2.22

2.2.23

2.2.24

2.2.25

Ecosystem specific

{
    "affected_functions": [
        "django.template.defaultfilters.dictsort",
        "django.template.defaultfilters.dictsortreversed"
    ]
}

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.2

Fixed

3.2.11

Affected versions

3.*

3.2

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.2.9

3.2.10

Ecosystem specific

{
    "affected_functions": [
        "django.template.defaultfilters.dictsort",
        "django.template.defaultfilters.dictsortreversed"
    ]
}

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0

Fixed

4.0.1

Affected versions

4.*

4.0

Ecosystem specific

{
    "affected_functions": [
        "django.template.defaultfilters.dictsort",
        "django.template.defaultfilters.dictsortreversed"
    ]
}