Sarah Boyce

The `django.contrib.gis.gdal.OGRGeometry` class fails to restrict external coordinate reference system definitions within GeoJSON input. This allows remote attackers to trigger server-side requests to destinations of their choice by providing specially crafted `crs` members.

An issue exists where `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache page()` decorator generate identical cache keys for requests that omit a header listed in the response’s `Vary` header and requests that include that header with an empty value. This behavior could allow remote attackers to access private data cached for a different request.

`django.contrib.gis.gdal.SpatialReference` and its associated `transform()` methods and `srs`/`srid` setters fail to restrict GDAL file and network access during string input parsing. This allows attackers to initiate server-side requests or read local files by providing specially crafted spatial reference strings.

An issue exists in the `save existing objects()` function within `django.forms.models.BaseModelFormSet`. The function incorrectly uses the presence of a primary key on a submitted form instance to verify if the instance belongs to the formset's limiting queryset. When a model's primary key is a field accepted by the form—such as a `OneToOneField`, a parent link in an inline formset, or a natural/UUID primary key—an authenticated user can populate the primary key via submitted data. This allows a user to delete rows outside the limiting queryset by forging management-form data, even without permissions for the targeted object. Models using the default AutoField primary key are not affected.

The `django.utils.translation.get supported language variant()` function is susceptible to a denial-of-service attack. This occurs when the system processes a large number of distinct and excessively long language codes, which are then stored as keys in an in-memory cache, leading to excessive process memory consumption.

A denial-of-service issue exists in the `django.utils.http.parse header parameters()` function. The problem arises from quadratic time complexity when parsing values containing numerous separators within a quoted parameter. An unauthenticated attacker can trigger this behavior by sending specially crafted headers, such as `Accept` or `Content-Type`, which are processed during content negotiation by `HttpRequest.accepts()`. The existing per-call length limit fails to restrict the combined size of repeated headers.

An incomplete fix in spatial lookups allows an attacker to trigger network requests by providing `bytes` values. This occurs through a crafted VRT (Virtual Raster Table) document that references an external raster source, causing the Django process to initiate the request.

When `SESSION SAVE EVERY REQUEST` is set to `True`, response headers do not vary based on cookies if a session remains unmodified. This allows a remote attacker to steal a user's session after the victim visits a cached public page. This is a session fixation issue where a session identifier can be compromised via public cached content.

ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE UPLOAD MAX MEMORY SIZE` limit. This allows large files to be loaded into memory, which can lead to service degradation and a potential denial-of-service. ASGI (Asynchronous Server Gateway Interface) is a standard for asynchronous Python web servers to communicate with web applications.

An issue in `django.middleware.cache.UpdateCacheMiddleware` causes requests where the `Vary` header contains an asterisk (`'*'`) to be erroneously cached. This behavior can lead to the storage and subsequent delivery of private data to unauthorized users.