Django Template Language Vulnerability: Information Disclosure Risk in python-django
Summary
CVE-2021-45116: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Affects python-django across 2 version ranges.
< 2:2.2.26-1~deb11u1
>= 635d53a86a36cde7866b9caefeb64d809e6bfcd9, < 44e7cca62382f2535ed0f5d2842b433f0bd23a57
Fixed in 2:2.2.26-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and a templating engine. The vulnerability in question affects the Django Template Language, specifically the dictsort template filter, which can lead to unintended method calls or information disclosure if improperly utilized.
Vulnerability Detail
The vulnerability arises from the way the Django Template Language resolves variables within the dictsort template filter. If an attacker crafts a specific key, it could lead to information disclosure or unintended method calls, potentially exposing sensitive data or allowing unauthorized actions. This issue affects Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1, with a CVSS score of 7.5 indicating a high severity level.
How To Fix
Minimum fixed version
2:2.2.26-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider avoiding the use of the dictsort template filter with untrusted input. Ensure that any keys passed to this filter are sanitized and validated to prevent potential exploitation.
Conclusion
The vulnerability in the Django Template Language's dictsort filter poses a significant risk of information disclosure and unintended method calls. It is crucial for users of affected Django versions to upgrade to secure releases promptly to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python-django →
FAQ
The vulnerability can lead to information disclosure or unintended method calls, potentially exposing sensitive data.
Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If you cannot upgrade immediately, avoid using the dictsort template filter with untrusted input and ensure that any keys passed are sanitized.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
