Jacob Walls

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display for field()` function did not obfuscate the password field of user models other than `AUTH USER MODEL`, or of an `AUTH USER MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.

`django.contrib.gis.gdal.SpatialReference` and its associated `transform()` methods and `srs`/`srid` setters fail to restrict GDAL file and network access during string input parsing. This allows attackers to initiate server-side requests or read local files by providing specially crafted spatial reference strings.

The `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption. This occurs when processing multipart file uploads that use base64 `Content-Transfer-Encoding`, as the data may be buffered entirely in memory before it is passed to upload handlers.

The `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()` function, utilized by `django.contrib.gis.forms.GeometryField`, fails to escape invalid submitted values before they are logged. This allows remote attackers to inject or forge log entries by providing a specially crafted geometry value.

The `django.contrib.gis.gdal.OGRGeometry` class fails to restrict external coordinate reference system definitions within GeoJSON input. This allows remote attackers to trigger server-side requests to destinations of their choice by providing specially crafted `crs` members.

An issue exists where `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache page()` decorator generate identical cache keys for requests that omit a header listed in the response’s `Vary` header and requests that include that header with an empty value. This behavior could allow remote attackers to access private data cached for a different request.

A denial-of-service issue exists in the `django.utils.http.parse header parameters()` function. The problem arises from quadratic time complexity when parsing values containing numerous separators within a quoted parameter. An unauthenticated attacker can trigger this behavior by sending specially crafted headers, such as `Accept` or `Content-Type`, which are processed during content negotiation by `HttpRequest.accepts()`. The existing per-call length limit fails to restrict the combined size of repeated headers.

An issue exists in the `save existing objects()` function within `django.forms.models.BaseModelFormSet`. The function incorrectly uses the presence of a primary key on a submitted form instance to verify if the instance belongs to the formset's limiting queryset. When a model's primary key is a field accepted by the form—such as a `OneToOneField`, a parent link in an inline formset, or a natural/UUID primary key—an authenticated user can populate the primary key via submitted data. This allows a user to delete rows outside the limiting queryset by forging management-form data, even without permissions for the targeted object. Models using the default AutoField primary key are not affected.

GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. This process allows untrusted input, such as spatial-field filters submitted via the Django admin changelist query string by staff users with view permissions, to reach the constructor. If a `dict` or a `str` containing its JSON representation is provided, it is opened in write mode, enabling an attacker to write a file with a chosen name and content through a file-backed GDAL driver. Other `str` values are treated as datasources, which can trigger outbound network requests via a GDAL virtual filesystem handler. Writing files to locations subsequently imported by the application may lead to remote code execution.

GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects provided as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. This occurs because the process triggers unbounded recursion, leading to a segmentation fault in the underlying GEOS library. This issue also affects spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field.

An issue exists where `DomainNameValidator` fails to prohibit newlines in domain names. While `CharField` strips newlines when used via a form field, other implementations may allow them. If an application incorporates these values containing newlines into an HTTP response, header injection can occur. Header injection is a technique used to insert malicious data into HTTP headers, potentially allowing attackers to manipulate the response sent to the client.

`UpdateCacheMiddleware` and the `cache page()` decorator cache responses that vary on cookies when the incoming request contains unrelated cookies. This behavior allows remote attackers to access private data stored in the shared cache.

An issue exists where `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object. This can lead to the disclosure of adjacent memory or cause service degradation through a potential segmentation fault—a specific type of error that occurs when a program attempts to access a memory location it is not allowed to access—when the `vsi buffer` property is accessed.

An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where the `Authorization` header is not added to the `Vary` response header for requests that include that header but lack `Cache-Control: public`. This allows remote attackers to access private cached responses by making unauthenticated requests to the same URL.

ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE UPLOAD MAX MEMORY SIZE` limit. This allows large files to be loaded into memory, which can lead to service degradation and a potential denial-of-service. ASGI (Asynchronous Server Gateway Interface) is a standard for asynchronous Python web servers to communicate with web applications.

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29 Description A flaw exists in the permission validation process for inline model instances within `GenericInlineModelAdmin` when handling forged `POST` data. This could allow unauthorized access or modification of data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description The `MultiPartParser` component is susceptible to performance degradation when processing multipart uploads containing `Content-Transfer-Encoding: base64` with excessive whitespace. Remote attackers can exploit this to negatively impact system performance. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description ASGI requests lacking or underreporting the `Content-Length` header may bypass the `DATA UPLOAD MAX MEMORY SIZE` limit when processing `HttpRequest.body`, potentially allowing attackers to upload an unrestricted request body into memory. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. Recommendations Update to Django version 4.2.30 or later. Update to Django version 5.2.13 or later. Update to Django version 6.0.4 or later.

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29 Description The `ASGIRequest` component allows a remote attacker to spoof headers due to an ambiguous mapping of header variants (with hyphens or with underscores) to a single version with underscores. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3 Django versions 5.2 through 5.2.12 Django versions 4.2 through 4.2.29 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier Description An issue was discovered where admin changelist forms using `ModelAdmin.list editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.