Debian Python-Django vulnerabilities

CVE-2025-48432 [MEDIUM] CVE-2025-48432: python-django - An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 b... An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems. Scope: loc

CVE-2025-27556 [MEDIUM] CVE-2025-27556: python-django - An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NF... An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characte

CVE-2025-64458 [HIGH] CVE-2025-64458: python-django - An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before ... An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a ver

CVE-2025-59682 [LOW] CVE-2025-59682: python-django - An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 ... An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory. Scope: local bookworm: resolved (

CVE-2024-41991 [HIGH] CVE-2024-41991: python-django - An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The ur... An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Scope: local bookworm: resolved (fixed in 3:3.2.25-0+deb12u1) bullseye: resolved (fixed

CVE-2024-42005 [HIGH] CVE-2024-42005: python-django - An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QueryS... An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. Scope: local bookworm: resolved (fixed in 3:3.2.25-0+deb12u1) bullseye: resolved (fixed in 2:2.2.28-1~deb11u11) forky: res

CVE-2024-38875 [HIGH] CVE-2024-38875: python-django - An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize... An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 3:4.2.14-1) sid: resolved (fixed in 3:4.2.14-1) trixie: resolved (fixed in 3:4.2.14-1)

CVE-2024-53907 [HIGH] CVE-2024-53907: python-django - An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 b... An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities. Scope: local bookworm: resolved (fixed in 3:3.2.25-0+deb12u1) bullseye: resolved

CVE-2024-39614 [HIGH] CVE-2024-39614: python-django - An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_su... An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. Scope: local bookworm: resolved (fixed in 3:3.2.25-0+deb12u1) bullseye: resolved (fixed in 2:2.2.28-1~deb11u11) forky: resolved (fixed in

CVE-2024-41990 [HIGH] CVE-2024-41990: python-django - An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The ur... An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 3:4.2.15-1) sid: resolved (fixed in 3:4.2.15-1) trixie: r

CVE-2024-27351 [HIGH] CVE-2024-27351: python-django - In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django... In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

CVE-2024-45230 [HIGH] CVE-2024-45230: python-django - An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 be... An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 3:4.2.16-1) sid: resolved (fixed in 3:

CVE-2024-41989 [HIGH] CVE-2024-41989: python-django - An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The fl... An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. Scope: local bookworm: resolved (fixed in 3:3.2.25-0+deb12u1) bullseye: resolved (fixed in 2:2.2.28-1~deb11u11) forky:

CVE-2024-24680 [HIGH] CVE-2024-24680: python-django - An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Djan... An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. Scope: local bookworm: resolved (fixed in 3:3.2.25-0+deb12u1) bullseye: resolved (fixed in 2:2.2.28-1~deb11u7) forky: resolved (fixed in 3:4.2.10-

CVE-2024-39329 [MEDIUM] CVE-2024-39329: python-django - An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The dj... An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. Scope: local bookworm: resolved (fixed in 3:3.2.25-0+deb12u1) bullseye: resolved (fixed in 2:

CVE-2024-39330 [MEDIUM] CVE-2024-39330: python-django - An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derive... An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes

CVE-2024-56374 [MEDIUM] CVE-2024-56374: python-django - An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 b... An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.Gen

CVE-2024-45231 [MEDIUM] CVE-2024-45231: python-django - An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contri... An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing). Scope: local bo

CVE-2024-53908 [CRITICAL] CVE-2024-53908: python-django - An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 b... An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.) Scope: local bookwor

CVE-2023-31047 [CRITICAL] CVE-2023-31047: python-django - In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was poss... In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested o