Stackered

The `django.contrib.auth.handlers.modwsgi.check password()` function, used for authentication via `mod wsgi`, is susceptible to a timing attack. This allows remote attackers to potentially enumerate users. Earlier, unsupported Django series, including versions 5.0.x, 4.1.x, and 3.2.x, may also be affected.

An issue exists in Django where `FilteredRelation` is susceptible to SQL injection in column aliases. This occurs when a crafted dictionary is used with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Approximately 1.7 million potentially affected devices have been identified. The issue involves the use of the `QuerySet.annotate()` and `QuerySet.alias()` functions, which can be exploited through manipulated column aliases. The vulnerable component is `FilteredRelation`.

The `django.utils.archive.extract()` function allows for potential directory traversal when handling archives with file paths that share a common prefix with the target directory. This issue affects the "startapp --template" and "startproject --template" commands.