Jake Howard

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display for field()` function did not obfuscate the password field of user models other than `AUTH USER MODEL`, or of an `AUTH USER MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.

`django.contrib.gis.gdal.SpatialReference` and its associated `transform()` methods and `srs`/`srid` setters fail to restrict GDAL file and network access during string input parsing. This allows attackers to initiate server-side requests or read local files by providing specially crafted spatial reference strings.

The `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption. This occurs when processing multipart file uploads that use base64 `Content-Transfer-Encoding`, as the data may be buffered entirely in memory before it is passed to upload handlers.

The `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()` function, utilized by `django.contrib.gis.forms.GeometryField`, fails to escape invalid submitted values before they are logged. This allows remote attackers to inject or forge log entries by providing a specially crafted geometry value.

An issue exists where `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache page()` decorator generate identical cache keys for requests that omit a header listed in the response’s `Vary` header and requests that include that header with an empty value. This behavior could allow remote attackers to access private data cached for a different request.

A denial-of-service issue exists in the `django.utils.http.parse header parameters()` function. The problem arises from quadratic time complexity when parsing values containing numerous separators within a quoted parameter. An unauthenticated attacker can trigger this behavior by sending specially crafted headers, such as `Accept` or `Content-Type`, which are processed during content negotiation by `HttpRequest.accepts()`. The existing per-call length limit fails to restrict the combined size of repeated headers.

The `django.utils.cache.has vary header()` function does not strip leading or trailing whitespace from `Vary` response header values before comparison. This allows remote attackers to read cached responses by making requests to URLs that have whitespace-padded `Vary` header values.

An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where `Cache-Control` response directives are not matched case-insensitively. This allows remote attackers to read responses that were incorrectly cached due to the use of uppercase or mixed-case values in the `Cache-Control` directives.

An issue exists in `django.core.mail.backends.smtp.EmailBackend` where the system fails to prevent the reuse of a partially-initialized connection following a failed `STARTTLS` handshake when the `fail silently` variable is set to `True`. This allows on-path network attackers to intercept and read email content in cleartext.

When `SESSION SAVE EVERY REQUEST` is set to `True`, response headers do not vary based on cookies if a session remains unmodified. This allows a remote attacker to steal a user's session after the victim visits a cached public page. This is a session fixation issue where a session identifier can be compromised via public cached content.

The `FilteredRelation` component is susceptible to SQL injection in column aliases through the use of control characters. This occurs when a crafted dictionary is used with dictionary expansion as the `**kwargs` passed to the `annotate()`, `aggregate()`, `extra()`, `values()`, `values list()`, and `alias()` methods of `QuerySet`.

The `django.contrib.auth.handlers.modwsgi.check password()` function, used for authentication via `mod wsgi`, is susceptible to a timing attack. This allows remote attackers to potentially enumerate users. Earlier, unsupported Django series, including versions 5.0.x, 4.1.x, and 3.2.x, may also be affected.

The `ASGIRequest` component is susceptible to a denial-of-service condition. A remote attacker can exploit this by sending a specially crafted request containing duplicate headers.

The `html.parser.HTMLParser` class contains a flaw where processing certain crafted malformed inputs results in worst-case quadratic complexity. This occurs due to the use of a regular expression with inefficient computational complexity, which can lead to CPU exhaustion and an amplified denial-of-service.

A memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash or denial of service. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. It can only be exploited by admin users with permission to upload images or documents. Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code.