The `django.contrib.gis.gdal.OGRGeometry` class fails to restrict external coordinate reference system definitions within GeoJSON input. This allows remote attackers to trigger server-side requests to destinations of their choice by providing specially crafted `crs` members.