Jake Howard

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.6 Django versions prior to 5.2.15 **Description** An issue exists in `django.core.mail.backends.smtp.EmailBackend` where the system fails to prevent the reuse of a partially-initialized connection following a failed `STARTTLS` handshake when the `fail silently` variable is set to `True`. This allows on-path network attackers to intercept and read email content in cleartext. **Recommendations** Update to version 6.0.6 or later. Update to version 5.2.15 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where `Cache-Control` response directives are not matched case-insensitively. This allows remote attackers to read responses that were incorrectly cached due to the use of uppercase or mixed-case values in the `Cache-Control` directives. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** The `django.utils.cache.has vary header()` function does not strip leading or trailing whitespace from `Vary` response header values before comparison. This allows remote attackers to read cached responses by making requests to URLs that have whitespace-padded `Vary` header values. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.4 Django versions 5.2 through 5.2.13 **Description** When `SESSION SAVE EVERY REQUEST` is set to `True`, response headers do not vary based on cookies if a session remains unmodified. This allows a remote attacker to steal a user's session after the victim visits a cached public page. This is a session fixation issue where a session identifier can be compromised via public cached content. **Recommendations** Update Django versions 6.0 through 6.0.4 to version 6.0.5. Update Django versions 5.2 through 5.2.13 to version 5.2.14.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `FilteredRelation` component is susceptible to SQL injection in column aliases through the use of control characters. This occurs when a crafted dictionary is used with dictionary expansion as the `**kwargs` passed to the `annotate()`, `aggregate()`, `extra()`, `values()`, `values list()`, and `alias()` methods of `QuerySet`. **Recommendations** Update to Django version 6.0.2 or later. Update to Django version 5.2.11 or later. Update to Django version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.2 Django versions prior to 5.2.11 Django versions prior to 4.2.28 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `django.contrib.auth.handlers.modwsgi.check password()` function, used for authentication via `mod wsgi`, is susceptible to a timing attack. This allows remote attackers to potentially enumerate users. Earlier, unsupported Django series, including versions 5.0.x, 4.1.x, and 3.2.x, may also be affected. **Recommendations** Update to Django version 6.0.2 or later. Update to Django version 5.2.11 or later. Update to Django version 4.2.28 or later. Update to a supported Django version to address potential issues in earlier, unsupported series.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `ASGIRequest` component is susceptible to a denial-of-service condition. A remote attacker can exploit this by sending a specially crafted request containing duplicate headers. **Recommendations** Update Django to version 6.0.2 or later. Update Django to version 5.2.11 or later. Update Django to version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `html.parser.HTMLParser` class contains a flaw where processing certain crafted malformed inputs results in worst-case quadratic complexity. This occurs due to the use of a regular expression with inefficient computational complexity, which can lead to CPU exhaustion and an amplified denial-of-service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wagtail versions prior to 4.1.4 and 4.2.2 **Description** A memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash or denial of service. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. It can only be exploited by admin users with permission to upload images or documents. Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code. **Recommendations** For versions prior to 4.1.4, update to version 4.1.4 or later. For versions prior to 4.2.2, update to version 4.2.2 or later. As a temporary workaround, consider adding extra protections outside of Wagtail to limit the size of uploaded files, such as configuring `client max body size` in Nginx, `LimitRequestBody` in Apache, or using Cloudflare's or CloudFront's built-in limitations.