UBUNTU-CVE-2020-15225

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2020-15225
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-15225.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-15225
Related
Published
2021-04-29T21:15:00Z
Modified
2025-04-23T15:07:46Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a MaxValueValidator with a a default limit_value of 1e50 to the form field used by NumberFilter instances. In addition, NumberFilter implements the new get_max_validator() which should return a configured validator instance to customise the limit, or else None to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.

References

Affected packages

Ubuntu:Pro:16.04:LTS / django-filter

Package

Name
django-filter
Purl
pkg:deb/ubuntu/django-filter@0.11.0-2?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.9.2-1
0.11.0-1
0.11.0-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / django-filter

Package

Name
django-filter
Purl
pkg:deb/ubuntu/django-filter@1.1.0-1?arch=source&distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.4-1
1.0.4-2
1.1.0-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / django-filter

Package

Name
django-filter
Purl
pkg:deb/ubuntu/django-filter@2.1.0-1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.0-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / django-filter

Package

Name
django-filter
Purl
pkg:deb/ubuntu/django-filter@2.4.0-1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.4.0-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / django-filter

Package

Name
django-filter
Purl
pkg:deb/ubuntu/django-filter@24.2-1?arch=source&distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

23.*

23.5-1

24.*

24.2-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / django-filter

Package

Name
django-filter
Purl
pkg:deb/ubuntu/django-filter@23.5-1?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

23.*

23.2-3
23.3post1-1
23.4-1
23.5-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:25.04 / django-filter

Package

Name
django-filter
Purl
pkg:deb/ubuntu/django-filter@25.1-1?arch=source&distro=plucky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

24.*

24.2-1
24.3-1

25.*

25.1-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}