CVE-2020-15225 — Django-filter vulnerability

Vendor	Product	Version range	Fixed in
carltongibson	django-filter	< 2.4.0	2.4.0
debian	django-filter	< django-filter 2.4.0-1 (bookworm)	django-filter 2.4.0-1 (bookworm)
django-filter_project	django-filter	< 2.4.0	2.4.0
django-filter_project	django-filter	>= 0 < 2.4.0-1	2.4.0-1
django-filter_project	django-filter	>= 0 < 2.4.0-1	2.4.0-1
django-filter_project	django-filter	>= 0 < 2.4.0-1	2.4.0-1
django-filter_project	django-filter	>= 0 < 2.4.0-1	2.4.0-1
django-filter_project	django-filter	>= 0 < 2.4.0	2.4.0
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—

OSV

CVE-2020-15225: django-filter is a generic system for filtering Django QuerySets based on user selections

osv·2021-04-29·CVSS 6.5

CVE-2020-15225 [MEDIUM] CVE-2020-15225: django-filter is a generic system for filtering Django QuerySets based on user selections django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.

GHSA

Potential DoS with NumberFilter conversion to integer values.

ghsa·2020-09-28

CVE-2020-15225 [HIGH] CWE-681 Potential DoS with NumberFilter conversion to integer values. Potential DoS with NumberFilter conversion to integer values. ### Impact Automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. ### Patches Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. ### Workarounds Users may manually apply an equivalent validator if they are not able to upgrade. ### For more information If you have any questions or comments ab

OSV

Potential DoS with NumberFilter conversion to integer values.

osv·2020-09-28

CVE-2020-15225 [HIGH] Potential DoS with NumberFilter conversion to integer values. Potential DoS with NumberFilter conversion to integer values. ### Impact Automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. ### Patches Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. ### Workarounds Users may manually apply an equivalent validator if they are not able to upgrade. ### For more information If you have any questions or comments ab

Red Hat

python-django-filter: Maliciously input using exponential format may cause denial of service

vendor_redhat·2021-04-29·CVSS 7.5

CVE-2020-15225 [HIGH] CWE-681 python-django-filter: Maliciously input using exponential format may cause denial of service python-django-filter: Maliciously input using exponential format may cause denial of service django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equi

Debian

CVE-2020-15225: django-filter - django-filter is a generic system for filtering Django QuerySets based on user s...

vendor_debian·2020·CVSS 7.5

CVE-2020-15225 [HIGH] CVE-2020-15225: django-filter - django-filter is a generic system for filtering Django QuerySets based on user s... django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade. Scope: local bookworm: resolved (fixed in 2.

CVE-2020-15225: django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated…

Affected

CVSS provenance