Jacob Walls

**Name of the Vulnerable Software and Affected Versions** Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7 **Description** GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. This process allows untrusted input, such as spatial-field filters submitted via the Django admin changelist query string by staff users with view permissions, to reach the constructor. If a `dict` or a `str` containing its JSON representation is provided, it is opened in write mode, enabling an attacker to write a file with a chosen name and content through a file-backed GDAL driver. Other `str` values are treated as datasources, which can trigger outbound network requests via a GDAL virtual filesystem handler. Writing files to locations subsequently imported by the application may lead to remote code execution. **Recommendations** Update Django versions 5.2 through 5.2.16 to version 5.2.17. Update Django versions 6.0 through 6.0.7 to version 6.0.8.

**Name of the Vulnerable Software and Affected Versions** Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7 **Description** GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects provided as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. This occurs because the process triggers unbounded recursion, leading to a segmentation fault in the underlying GEOS library. This issue also affects spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field. **Recommendations** Update to version 5.2.17. Update to version 6.0.8.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.6 Django versions 5.2 through 5.2.15 **Description** `UpdateCacheMiddleware` and the `cache page()` decorator cache responses that vary on cookies when the incoming request contains unrelated cookies. This behavior allows remote attackers to access private data stored in the shared cache. **Recommendations** Update Django versions 6.0 through 6.0.6 to version 6.0.7. Update Django versions 5.2 through 5.2.15 to version 5.2.16.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.6 Django versions 5.2 through 5.2.15 **Description** An issue exists where `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object. This can lead to the disclosure of adjacent memory or cause service degradation through a potential segmentation fault—a specific type of error that occurs when a program attempts to access a memory location it is not allowed to access—when the `vsi buffer` property is accessed. **Recommendations** Update Django versions 6.0 through 6.0.6 to version 6.0.7. Update Django versions 5.2 through 5.2.15 to version 5.2.16.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.7 Django versions prior to 5.2.16 **Description** An issue exists where `DomainNameValidator` fails to prohibit newlines in domain names. While `CharField` strips newlines when used via a form field, other implementations may allow them. If an application incorporates these values containing newlines into an HTTP response, header injection can occur. Header injection is a technique used to insert malicious data into HTTP headers, potentially allowing attackers to manipulate the response sent to the client. **Recommendations** Update Django to version 6.0.7 or later. Update Django to version 5.2.16 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where the `Authorization` header is not added to the `Vary` response header for requests that include that header but lack `Cache-Control: public`. This allows remote attackers to access private cached responses by making unauthenticated requests to the same URL. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.4 Django versions 5.2 through 5.2.13 **Description** ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE UPLOAD MAX MEMORY SIZE` limit. This allows large files to be loaded into memory, which can lead to service degradation and a potential denial-of-service. ASGI (Asynchronous Server Gateway Interface) is a standard for asynchronous Python web servers to communicate with web applications. **Recommendations** Update versions 6.0 through 6.0.4 to version 6.0.5. Update versions 5.2 through 5.2.13 to version 5.2.14. Configure a limit at the web server level to avoid relying solely on `FILE UPLOAD MAX MEMORY SIZE`.

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29 Description A flaw exists in the permission validation process for inline model instances within `GenericInlineModelAdmin` when handling forged `POST` data. This could allow unauthorized access or modification of data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3 Django versions 5.2 through 5.2.12 Django versions 4.2 through 4.2.29 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier Description An issue was discovered where admin changelist forms using `ModelAdmin.list editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description ASGI requests lacking or underreporting the `Content-Length` header may bypass the `DATA UPLOAD MAX MEMORY SIZE` limit when processing `HttpRequest.body`, potentially allowing attackers to upload an unrestricted request body into memory. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. Recommendations Update to Django version 4.2.30 or later. Update to Django version 5.2.13 or later. Update to Django version 6.0.4 or later.

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29 Description The `ASGIRequest` component allows a remote attacker to spoof headers due to an ambiguous mapping of header variants (with hyphens or with underscores) to a single version with underscores. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description The `MultiPartParser` component is susceptible to performance degradation when processing multipart uploads containing `Content-Transfer-Encoding: base64` with excessive whitespace. Remote attackers can exploit this to negatively impact system performance. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `FilteredRelation` component is susceptible to SQL injection in column aliases through the use of control characters. This occurs when a crafted dictionary is used with dictionary expansion as the `**kwargs` passed to the `annotate()`, `aggregate()`, `extra()`, `values()`, `values list()`, and `alias()` methods of `QuerySet`. **Recommendations** Update to Django version 6.0.2 or later. Update to Django version 5.2.11 or later. Update to Django version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `.QuerySet.order by()` function is susceptible to SQL injection when column aliases contain periods, particularly when a crafted dictionary is used with dictionary expansion within a `FilteredRelation`. This can occur when the same alias is utilized. Earlier, unsupported Django series, including versions 5.0.x, 4.1.x, and 3.2.x, may also be affected. **Recommendations** Update to Django version 6.0.2 or later. Update to Django version 5.2.11 or later. Update to Django version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.2 Django versions prior to 5.2.11 Django versions prior to 4.2.28 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `django.contrib.auth.handlers.modwsgi.check password()` function, used for authentication via `mod wsgi`, is susceptible to a timing attack. This allows remote attackers to potentially enumerate users. Earlier, unsupported Django series, including versions 5.0.x, 4.1.x, and 3.2.x, may also be affected. **Recommendations** Update to Django version 6.0.2 or later. Update to Django version 5.2.11 or later. Update to Django version 4.2.28 or later. Update to a supported Django version to address potential issues in earlier, unsupported series.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `ASGIRequest` component is susceptible to a denial-of-service condition. A remote attacker can exploit this by sending a specially crafted request containing duplicate headers. **Recommendations** Update Django to version 6.0.2 or later. Update Django to version 5.2.11 or later. Update Django to version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.2 Django versions prior to 5.2.11 Django versions prior to 4.2.28 **Description** A flaw in the GeoDjango `RasterField` implementation, specifically when using a PostGIS backend, allows remote attackers to perform SQL injection. The issue occurs because the software fails to properly parameterize the band index during raster lookup processing, allowing user-supplied input to be concatenated directly into SQL queries. This can lead to unauthorized information disclosure, data alteration, denial of service, or potential remote code execution on database hosts. Real-world incidents indicate that this issue has been actively exploited in targeted attacks against mapping platforms, location services, and geospatial analytics applications. The vulnerability is triggered via the `band` index parameter during raster lookups. **Recommendations** Update Django to version 6.0.2. Update Django to version 5.2.11. Update Django to version 4.2.28. Restrict access to raster endpoints to minimize the risk of exploitation. Enforce strict input validation on the `band` index parameter. Deploy WAF rules to filter common SQL injection patterns.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `django.utils.text.Truncator.chars()` and `Truncator.words()` methods, when used with `html=True`, and the `truncatechars html` and `truncatewords html` template filters are susceptible to a potential denial-of-service. This occurs when processing crafted inputs containing a large number of unmatched HTML end tags. **Recommendations** Update to Django version 6.0.2 or later. Update to Django version 5.2.11 or later. Update to Django version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 4.2 through 4.2.26 Django versions 5.1 through 5.1.14 Django versions 5.2 through 5.2.8 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** An issue exists in Django where `FilteredRelation` is susceptible to SQL injection in column aliases. This occurs when a crafted dictionary is used with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Approximately 1.7 million potentially affected devices have been identified. The issue involves the use of the `QuerySet.annotate()` and `QuerySet.alias()` functions, which can be exploited through manipulated column aliases. The vulnerable component is `FilteredRelation`. **Recommendations** Update to Django version 5.2.9 or later. Update to Django version 5.1.15 or later. Update to Django version 4.2.27 or later.

**Name of the Vulnerable Software and Affected Versions** xml.dom.minidom (affected versions not specified) **Description** The software experiences a performance issue when constructing deeply nested XML documents using methods like `appendChild()`. This is due to a quadratic algorithm within the ` clear id cache()` function, which is triggered when building nested elements. This can lead to availability impacts when processing excessively complex documents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.