Natalia Bidart

**Name of the Vulnerable Software and Affected Versions** Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7 **Description** An issue exists where `django.contrib.admin.utils.display for field()` renders `URLField` values as clickable links in the admin interface without proper validation. This allows stored cross-site scripting (XSS) against staff users who click the link if a value with an unsafe scheme is stored in the database. This occurs in applications that persist `URLField` data without running model validation, such as through direct queryset writes, deserialization, or bulk import of untrusted input. **Recommendations** Update Django versions 5.2 through 5.2.16 to version 5.2.17. Update Django versions 6.0 through 6.0.7 to version 6.0.8.

**Name of the Vulnerable Software and Affected Versions** Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7 **Description** GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects provided as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. This occurs because the process triggers unbounded recursion, leading to a segmentation fault in the underlying GEOS library. This issue also affects spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field. **Recommendations** Update to version 5.2.17. Update to version 6.0.8.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.17 Django versions prior to 6.0.8 **Description** A denial-of-service issue exists in the `check for language()` function within `django.utils.translation`. The problem occurs when the function receives numerous distinct and very long language codes, which are stored as keys in an in-memory cache, leading to excessive process memory consumption. These codes are passed to the function via the `set language()` view in `django.views.i18n`, which is not routed by default. Memory consumption is limited by the `DATA UPLOAD MAX MEMORY SIZE` setting and a fixed maximum number of cache entries. **Recommendations** Update to version 5.2.17 or later. Update to version 6.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7 **Description** GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. This process allows untrusted input, such as spatial-field filters submitted via the Django admin changelist query string by staff users with view permissions, to reach the constructor. If a `dict` or a `str` containing its JSON representation is provided, it is opened in write mode, enabling an attacker to write a file with a chosen name and content through a file-backed GDAL driver. Other `str` values are treated as datasources, which can trigger outbound network requests via a GDAL virtual filesystem handler. Writing files to locations subsequently imported by the application may lead to remote code execution. **Recommendations** Update Django versions 5.2 through 5.2.16 to version 5.2.17. Update Django versions 6.0 through 6.0.7 to version 6.0.8.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.6 Django versions 5.2 through 5.2.15 **Description** `UpdateCacheMiddleware` and the `cache page()` decorator cache responses that vary on cookies when the incoming request contains unrelated cookies. This behavior allows remote attackers to access private data stored in the shared cache. **Recommendations** Update Django versions 6.0 through 6.0.6 to version 6.0.7. Update Django versions 5.2 through 5.2.15 to version 5.2.16.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.7 Django versions prior to 5.2.16 **Description** An issue exists where `DomainNameValidator` fails to prohibit newlines in domain names. While `CharField` strips newlines when used via a form field, other implementations may allow them. If an application incorporates these values containing newlines into an HTTP response, header injection can occur. Header injection is a technique used to insert malicious data into HTTP headers, potentially allowing attackers to manipulate the response sent to the client. **Recommendations** Update Django to version 6.0.7 or later. Update Django to version 5.2.16 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** The `django.utils.cache.has vary header()` function does not strip leading or trailing whitespace from `Vary` response header values before comparison. This allows remote attackers to read cached responses by making requests to URLs that have whitespace-padded `Vary` header values. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where the `Authorization` header is not added to the `Vary` response header for requests that include that header but lack `Cache-Control: public`. This allows remote attackers to access private cached responses by making unauthenticated requests to the same URL. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.6 Django versions prior to 5.2.15 **Description** An issue exists in the `get signed cookie()` function within `django.http.HttpRequest`. The function employs a non-injective salt derivation by concatenating the cookie name and the salt argument. This allows a remote attacker to use a cookie in a context different from its original signing context by utilizing distinct `name` and `salt` pairs that result in the same concatenated string. **Recommendations** Update to version 6.0.6 or later. Update to version 5.2.15 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.6 Django versions prior to 5.2.15 **Description** An issue exists in `django.core.mail.backends.smtp.EmailBackend` where the system fails to prevent the reuse of a partially-initialized connection following a failed `STARTTLS` handshake when the `fail silently` variable is set to `True`. This allows on-path network attackers to intercept and read email content in cleartext. **Recommendations** Update to version 6.0.6 or later. Update to version 5.2.15 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where `Cache-Control` response directives are not matched case-insensitively. This allows remote attackers to read responses that were incorrectly cached due to the use of uppercase or mixed-case values in the `Cache-Control` directives. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description The `MultiPartParser` component is susceptible to performance degradation when processing multipart uploads containing `Content-Transfer-Encoding: base64` with excessive whitespace. Remote attackers can exploit this to negatively impact system performance. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description ASGI requests lacking or underreporting the `Content-Length` header may bypass the `DATA UPLOAD MAX MEMORY SIZE` limit when processing `HttpRequest.body`, potentially allowing attackers to upload an unrestricted request body into memory. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. Recommendations Update to Django version 4.2.30 or later. Update to Django version 5.2.13 or later. Update to Django version 6.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 4.2 before 4.2.29 Django versions 5.2 before 5.2.12 Django versions 6.0 before 6.0.3 Django versions 3.2.x and earlier Django versions 4.1.x and earlier Django versions 5.0.x and earlier **Description** A race condition exists in Django's file-system storage and file-based cache backends. This condition can lead to the creation of file system objects with incorrect permissions when concurrent requests are processed in multi-threaded environments. Specifically, a temporary `umask` change made by one thread can affect other threads, resulting in unintended file permissions. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. **Recommendations** Update Django to version 4.2.29 or later. Update Django to version 5.2.12 or later. Update Django to version 6.0.3 or later. Update Django to a version later than 3.2.x. Update Django to a version later than 4.1.x. Update Django to a version later than 5.0.x.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.2 Django versions 5.2 through 5.2.11 Django versions 4.2 through 4.2.28 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `URLField.to python()` function in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows. This normalization is disproportionately slow for certain Unicode characters, potentially allowing a remote attacker to cause a denial of service by submitting large URL inputs containing these characters. **Recommendations** Update Django to version 6.0.3 or later. Update Django to version 5.2.12 or later. Update Django to version 4.2.29 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `django.utils.text.Truncator.chars()` and `Truncator.words()` methods, when used with `html=True`, and the `truncatechars html` and `truncatewords html` template filters are susceptible to a potential denial-of-service. This occurs when processing crafted inputs containing a large number of unmatched HTML end tags. **Recommendations** Update to Django version 6.0.2 or later. Update to Django version 5.2.11 or later. Update to Django version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 4.2 through 4.2.26 Django versions 5.1 through 5.1.14 Django versions 5.2 through 5.2.8 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** An issue exists in Django where `FilteredRelation` is susceptible to SQL injection in column aliases. This occurs when a crafted dictionary is used with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Approximately 1.7 million potentially affected devices have been identified. The issue involves the use of the `QuerySet.annotate()` and `QuerySet.alias()` functions, which can be exploited through manipulated column aliases. The vulnerable component is `FilteredRelation`. **Recommendations** Update to Django version 5.2.9 or later. Update to Django version 5.1.15 or later. Update to Django version 4.2.27 or later.

**Name of the Vulnerable Software and Affected Versions** xml.dom.minidom (affected versions not specified) **Description** The software experiences a performance issue when constructing deeply nested XML documents using methods like `appendChild()`. This is due to a quadratic algorithm within the ` clear id cache()` function, which is triggered when building nested elements. This can lead to availability impacts when processing excessively complex documents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Django versions 4.2 through 4.2.26 Django versions 5.1 through 5.1.14 Django versions 5.2 through 5.2.8 **Description** An issue exists in the way Django handles XML input. Specifically, algorithmic complexity within the `django.core.serializers.xml serializer.getInnerText()` function can lead to a denial-of-service condition. A remote attacker could potentially exhaust CPU and memory resources by providing specially crafted XML input to the XML `Deserializer`. **Recommendations** Update to Django version 5.2.9 or later. Update to Django version 5.1.15 or later. Update to Django version 4.2.27 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 4.2.26 Django versions prior to 5.1.14 Django versions prior to 5.2.8 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The issue relates to algorithmic complexity within the `django.http.HttpResponseRedirect()` and `django.http.HttpResponsePermanentRedirect()` functions, and the `django.shortcuts.redirect` shortcut. The slow performance of NFKC normalization in Python on Windows can be exploited to trigger a denial-of-service (DoS) condition by providing specially crafted inputs containing a large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. **Recommendations** Upgrade to Django version 4.2.26 or later. Upgrade to Django version 5.1.14 or later. Upgrade to Django version 5.2.8 or later. Upgrade to a newer version of Django that addresses this issue if using versions 5.0.x, 4.1.x, or 3.2.x.