| Name | CVE-2021-45116 |
| Description | An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-3177-1, ELA-914-1 |
| Debian Bugs | 1003113 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| python-django (PTS) | jessie, jessie (lts) | 1.7.11-1+deb8u17 | vulnerable |
| stretch (security) | 1:1.10.7-2+deb9u17 | vulnerable | |
| stretch (lts), stretch | 1:1.10.7-2+deb9u23 | fixed | |
| buster, buster (lts) | 1:1.11.29-1+deb10u12 | fixed | |
| buster (security) | 1:1.11.29-1+deb10u11 | fixed | |
| bullseye (security), bullseye | 2:2.2.28-1~deb11u2 | fixed | |
| bookworm (security), bookworm | 3:3.2.19-1+deb12u1 | fixed | |
| sid, trixie | 3:4.2.16-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| python-django | source | stretch | 1:1.10.7-2+deb9u20 | ELA-914-1 | ||
| python-django | source | buster | 1:1.11.29-1+deb10u3 | DLA-3177-1 | ||
| python-django | source | bullseye | 2:2.2.26-1~deb11u1 | |||
| python-django | source | (unstable) | 2:3.2.11-1 | 1003113 |
[stretch] - python-django <postponed> (Minor issue; fix in next update)
https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
https://github.com/django/django/commit/c7fe895bca06daf12cc1670b56eaf72a1ef27a16 (3.2.11)
https://github.com/django/django/commit/c9f648ccfac5ab90fb2829a66da4f77e68c7f93a (2.2.26)
[jessie] - python-django <ignored> (Minor issue; patch too invasive to backport)