David Smith

The `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()` function, utilized by `django.contrib.gis.forms.GeometryField`, fails to escape invalid submitted values before they are logged. This allows remote attackers to inject or forge log entries by providing a specially crafted geometry value.

The `django.contrib.gis.gdal.OGRGeometry` class fails to restrict external coordinate reference system definitions within GeoJSON input. This allows remote attackers to trigger server-side requests to destinations of their choice by providing specially crafted `crs` members.

`django.contrib.gis.gdal.SpatialReference` and its associated `transform()` methods and `srs`/`srid` setters fail to restrict GDAL file and network access during string input parsing. This allows attackers to initiate server-side requests or read local files by providing specially crafted spatial reference strings.

A denial-of-service issue exists in the `django.utils.http.parse header parameters()` function. The problem arises from quadratic time complexity when parsing values containing numerous separators within a quoted parameter. An unauthenticated attacker can trigger this behavior by sending specially crafted headers, such as `Accept` or `Content-Type`, which are processed during content negotiation by `HttpRequest.accepts()`. The existing per-call length limit fails to restrict the combined size of repeated headers.