UBUNTU-CVE-2021-45116

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2021-45116

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-45116.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-45116

Upstream

CVE-2021-45116

Downstream

USN-5204-1

Related

USN-5204-1

Published

2022-01-04T10:00:00Z

Modified

2026-10-01T14:02:07Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Ubuntu - low

Summary

[none]

Details

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.

References

Affected packages

Ubuntu:Pro:14.04:LTS / python-django

Package

Name: python-django
Purl: pkg:deb/ubuntu/python-django?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.4-1ubuntu1

1.6-1

1.6.1-1

1.6.1-2

1.6.1-2ubuntu0.1

1.6.1-2ubuntu0.2

1.6.1-2ubuntu0.3

1.6.1-2ubuntu0.4

1.6.1-2ubuntu0.5

1.6.1-2ubuntu0.6

1.6.1-2ubuntu0.8

1.6.1-2ubuntu0.9

1.6.1-2ubuntu0.10

1.6.1-2ubuntu0.11

1.6.1-2ubuntu0.12

1.6.1-2ubuntu0.13

1.6.1-2ubuntu0.14

1.6.1-2ubuntu0.15

1.6.1-2ubuntu0.16

1.6.11-0ubuntu1

1.6.11-0ubuntu1.1

1.6.11-0ubuntu1.2

1.6.11-0ubuntu1.3

1.6.11-0ubuntu1.3+esm1

1.6.11-0ubuntu1.3+esm2

1.6.11-0ubuntu1.3+esm3

1.6.11-0ubuntu1.3+esm4

1.6.11-0ubuntu1.3+esm5

1.6.11-0ubuntu1.3+esm6

1.6.11-0ubuntu1.3+esm7

1.6.11-0ubuntu1.3+esm8

1.6.11-0ubuntu1.3+esm9

1.6.11-0ubuntu1.3+esm10

1.6.11-0ubuntu1.3+esm11

1.6.11-0ubuntu1.3+esm12

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "python-django",
            "binary_version":  "1.6.11-0ubuntu1.3+esm12"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-45116.json"

Ubuntu:Pro:16.04:LTS / python-django

Package

Name: python-django
Purl: pkg:deb/ubuntu/python-django?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.7.9-1ubuntu5

1.8.5-2ubuntu1

1.8.7-1ubuntu1

1.8.7-1ubuntu2

1.8.7-1ubuntu3

1.8.7-1ubuntu4

1.8.7-1ubuntu5

1.8.7-1ubuntu5.1

1.8.7-1ubuntu5.2

1.8.7-1ubuntu5.4

1.8.7-1ubuntu5.5

1.8.7-1ubuntu5.6

1.8.7-1ubuntu5.7

1.8.7-1ubuntu5.8

1.8.7-1ubuntu5.9

1.8.7-1ubuntu5.10

1.8.7-1ubuntu5.11

1.8.7-1ubuntu5.12

1.8.7-1ubuntu5.13

1.8.7-1ubuntu5.14

1.8.7-1ubuntu5.15

1.8.7-1ubuntu5.15+esm1

1.8.7-1ubuntu5.15+esm3

1.8.7-1ubuntu5.15+esm4

1.8.7-1ubuntu5.15+esm5

1.8.7-1ubuntu5.15+esm6

1.8.7-1ubuntu5.15+esm7

1.8.7-1ubuntu5.15+esm8

1.8.7-1ubuntu5.15+esm9

1.8.7-1ubuntu5.15+esm10

1.8.7-1ubuntu5.15+esm11

1.8.7-1ubuntu5.15+esm12

1.8.7-1ubuntu5.15+esm13

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "python-django",
            "binary_version":  "1.8.7-1ubuntu5.15+esm13"
        },
        {
            "binary_name":  "python-django-common",
            "binary_version":  "1.8.7-1ubuntu5.15+esm13"
        },
        {
            "binary_name":  "python3-django",
            "binary_version":  "1.8.7-1ubuntu5.15+esm13"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-45116.json"

Ubuntu:18.04:LTS / python-django

Package

Name: python-django
Purl: pkg:deb/ubuntu/python-django?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1:1.11.11-1ubuntu1.15

Affected versions

1:1.*

1:1.11.4-1ubuntu1

1:1.11.6-1ubuntu1

1:1.11.9-1ubuntu1

1:1.11.11-1ubuntu1

1:1.11.11-1ubuntu1.1

1:1.11.11-1ubuntu1.2

1:1.11.11-1ubuntu1.3

1:1.11.11-1ubuntu1.4

1:1.11.11-1ubuntu1.5

1:1.11.11-1ubuntu1.6

1:1.11.11-1ubuntu1.7

1:1.11.11-1ubuntu1.8

1:1.11.11-1ubuntu1.9

1:1.11.11-1ubuntu1.10

1:1.11.11-1ubuntu1.11

1:1.11.11-1ubuntu1.12

1:1.11.11-1ubuntu1.13

1:1.11.11-1ubuntu1.14

Ecosystem specific

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "python-django",
            "binary_version":  "1:1.11.11-1ubuntu1.15"
        },
        {
            "binary_name":  "python-django-common",
            "binary_version":  "1:1.11.11-1ubuntu1.15"
        },
        {
            "binary_name":  "python3-django",
            "binary_version":  "1:1.11.11-1ubuntu1.15"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-45116.json"

Ubuntu:20.04:LTS / python-django

Package

Name: python-django
Purl: pkg:deb/ubuntu/python-django?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2:2.2.12-1ubuntu0.9

Affected versions

1:1.*

1:1.11.22-1ubuntu1

2:2.*

2:2.2.6-1ubuntu1

2:2.2.9-2ubuntu1

2:2.2.10-1

2:2.2.10-1ubuntu1

2:2.2.11-1

2:2.2.12-1

2:2.2.12-1ubuntu0.1

2:2.2.12-1ubuntu0.2

2:2.2.12-1ubuntu0.3

2:2.2.12-1ubuntu0.4

2:2.2.12-1ubuntu0.5

2:2.2.12-1ubuntu0.6

2:2.2.12-1ubuntu0.7

2:2.2.12-1ubuntu0.8

Ecosystem specific

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "python3-django",
            "binary_version":  "2:2.2.12-1ubuntu0.9"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-45116.json"