Natalia Bidart

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where the `Authorization` header is not added to the `Vary` response header for requests that include that header but lack `Cache-Control: public`. This allows remote attackers to access private cached responses by making unauthenticated requests to the same URL. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where `Cache-Control` response directives are not matched case-insensitively. This allows remote attackers to read responses that were incorrectly cached due to the use of uppercase or mixed-case values in the `Cache-Control` directives. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.6 Django versions prior to 5.2.15 **Description** An issue exists in `django.core.mail.backends.smtp.EmailBackend` where the system fails to prevent the reuse of a partially-initialized connection following a failed `STARTTLS` handshake when the `fail silently` variable is set to `True`. This allows on-path network attackers to intercept and read email content in cleartext. **Recommendations** Update to version 6.0.6 or later. Update to version 5.2.15 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.6 Django versions prior to 5.2.15 **Description** An issue exists in the `get signed cookie()` function within `django.http.HttpRequest`. The function employs a non-injective salt derivation by concatenating the cookie name and the salt argument. This allows a remote attacker to use a cookie in a context different from its original signing context by utilizing distinct `name` and `salt` pairs that result in the same concatenated string. **Recommendations** Update to version 6.0.6 or later. Update to version 5.2.15 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.2.15 Django versions prior to 6.0.6 **Description** The `django.utils.cache.has vary header()` function does not strip leading or trailing whitespace from `Vary` response header values before comparison. This allows remote attackers to read cached responses by making requests to URLs that have whitespace-padded `Vary` header values. **Recommendations** Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description The `MultiPartParser` component is susceptible to performance degradation when processing multipart uploads containing `Content-Transfer-Encoding: base64` with excessive whitespace. Remote attackers can exploit this to negatively impact system performance. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description ASGI requests lacking or underreporting the `Content-Length` header may bypass the `DATA UPLOAD MAX MEMORY SIZE` limit when processing `HttpRequest.body`, potentially allowing attackers to upload an unrestricted request body into memory. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. Recommendations Update to Django version 4.2.30 or later. Update to Django version 5.2.13 or later. Update to Django version 6.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 4.2 before 4.2.29 Django versions 5.2 before 5.2.12 Django versions 6.0 before 6.0.3 Django versions 3.2.x and earlier Django versions 4.1.x and earlier Django versions 5.0.x and earlier **Description** A race condition exists in Django's file-system storage and file-based cache backends. This condition can lead to the creation of file system objects with incorrect permissions when concurrent requests are processed in multi-threaded environments. Specifically, a temporary `umask` change made by one thread can affect other threads, resulting in unintended file permissions. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. **Recommendations** Update Django to version 4.2.29 or later. Update Django to version 5.2.12 or later. Update Django to version 6.0.3 or later. Update Django to a version later than 3.2.x. Update Django to a version later than 4.1.x. Update Django to a version later than 5.0.x.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.2 Django versions 5.2 through 5.2.11 Django versions 4.2 through 4.2.28 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `URLField.to python()` function in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows. This normalization is disproportionately slow for certain Unicode characters, potentially allowing a remote attacker to cause a denial of service by submitting large URL inputs containing these characters. **Recommendations** Update Django to version 6.0.3 or later. Update Django to version 5.2.12 or later. Update Django to version 4.2.29 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `django.utils.text.Truncator.chars()` and `Truncator.words()` methods, when used with `html=True`, and the `truncatechars html` and `truncatewords html` template filters are susceptible to a potential denial-of-service. This occurs when processing crafted inputs containing a large number of unmatched HTML end tags. **Recommendations** Update to Django version 6.0.2 or later. Update to Django version 5.2.11 or later. Update to Django version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions 4.2 through 4.2.26 Django versions 5.1 through 5.1.14 Django versions 5.2 through 5.2.8 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** An issue exists in Django where `FilteredRelation` is susceptible to SQL injection in column aliases. This occurs when a crafted dictionary is used with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Approximately 1.7 million potentially affected devices have been identified. The issue involves the use of the `QuerySet.annotate()` and `QuerySet.alias()` functions, which can be exploited through manipulated column aliases. The vulnerable component is `FilteredRelation`. **Recommendations** Update to Django version 5.2.9 or later. Update to Django version 5.1.15 or later. Update to Django version 4.2.27 or later.

**Name of the Vulnerable Software and Affected Versions** xml.dom.minidom (affected versions not specified) **Description** The software experiences a performance issue when constructing deeply nested XML documents using methods like `appendChild()`. This is due to a quadratic algorithm within the ` clear id cache()` function, which is triggered when building nested elements. This can lead to availability impacts when processing excessively complex documents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Django versions 4.2 through 4.2.26 Django versions 5.1 through 5.1.14 Django versions 5.2 through 5.2.8 **Description** An issue exists in the way Django handles XML input. Specifically, algorithmic complexity within the `django.core.serializers.xml serializer.getInnerText()` function can lead to a denial-of-service condition. A remote attacker could potentially exhaust CPU and memory resources by providing specially crafted XML input to the XML `Deserializer`. **Recommendations** Update to Django version 5.2.9 or later. Update to Django version 5.1.15 or later. Update to Django version 4.2.27 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 5.1.14, prior to 4.2.26, and prior to 5.2.8 **Description** Django is susceptible to a SQL injection issue due to improper handling of dictionary expansion when using the `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()` methods, as well as the `Q()` class. An attacker can inject malicious SQL code by crafting a dictionary with a specifically designed ` connector` argument. This allows for potential database manipulation, including bypassing authentication, data exfiltration, and privilege escalation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. The vulnerability arises when user-controlled input is directly passed to these methods via dictionary expansion. The ` connector` parameter can be manipulated to alter query logic, for example, changing 'AND' to 'OR'. **Recommendations** Update to Django versions 5.2.8, 5.1.14, or 4.2.26. Audit code for usages of `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()` with dictionary expansion. Never pass `request.GET.dict()` directly to QuerySet methods. Implement input validation using Django Forms. Implement whitelisting of filter parameters. Explicitly map fields instead of using dictionary expansion. Monitor logs for usage of the ` connector` and ` negated` parameters.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 4.2.26 Django versions prior to 5.1.14 Django versions prior to 5.2.8 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The issue relates to algorithmic complexity within the `django.http.HttpResponseRedirect()` and `django.http.HttpResponsePermanentRedirect()` functions, and the `django.shortcuts.redirect` shortcut. The slow performance of NFKC normalization in Python on Windows can be exploited to trigger a denial-of-service (DoS) condition by providing specially crafted inputs containing a large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. **Recommendations** Upgrade to Django version 4.2.26 or later. Upgrade to Django version 5.1.14 or later. Upgrade to Django version 5.2.8 or later. Upgrade to a newer version of Django that addresses this issue if using versions 5.0.x, 4.1.x, or 3.2.x.

**Name of the Vulnerable Software and Affected Versions** Django versions 1.4 through 1.4.12 Django versions 1.5 through 1.5.7 Django versions 1.6 through 1.6.4 Django versions 1.7 before 1.7b4 **Description** The issue allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers, due to the improper inclusion of the `Vary: Cookie` or `Cache-Control` header in responses. **Recommendations** For Django versions 1.4 through 1.4.12, update to version 1.4.13 or later. For Django versions 1.5 through 1.5.7, update to version 1.5.8 or later. For Django versions 1.6 through 1.6.4, update to version 1.6.5 or later. For Django versions 1.7 before 1.7b4, update to version 1.7b4 or later.