Bugzilla – Bug 1194117
VUL-0: CVE-2021-45116: python-Django,python-Django1: Potential information disclosure in dictsort template filter
Last modified: 2022-06-10 08:47:59 UTC
CVE-2021-45115: Denial-of-service possibility in ``UserAttributeSimilarityValidator`` ===================================================================================== :class:`.UserAttributeSimilarityValidator` incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack. In order to mitigate this issue, relatively long values are now ignored by ``UserAttributeSimilarityValidator``. Affected versions ================= * Django main development branch * Django 4.0 * Django 3.2 * Django 2.2 Resolution ========== Included with this email are patches implementing the changes described above for each affected version of Django. On the release date, these patches will be applied to the Django development repository and the following releases will be issued along with disclosure of the issues: * Django 4.0.1 * Django 3.2.11 * Django 2.2.26
The title in the first comment is wrong, my apologies. It should say: CVE-2021-45116: Potential information disclosure in ``dictsort`` template filter
Created attachment 854850 [details] Upstream patch 2.2
Created attachment 854851 [details] Upstream patch 3.2
Created attachment 854852 [details] Upstream patch 4.0
Created attachment 854853 [details] Upstream patch main branch
The correct bug description is the following: Due to leveraging the Django Template Language's variable resolution logic, the :tfilter:`dictsort` template filter was potentially vulnerable to information disclosure or unintended method calls, if passed a suitably crafted key. In order to avoid this possibility, ``dictsort`` now works with a restricted resolution logic, that will not call methods, nor allow indexing on dictionaries. Affected codestreams: - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update / python-Django - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update / python-Django1 Also affected on openSUSE: - openSUSE:Leap:15.2 / python-Django (EOL by the time of the CRD) - openSUSE:Backports:SLE-15-SP2 / python-Django (EOL by the time of the CRD) - openSUSE:Backports:SLE-15-SP3 / python-Django - openSUSE:Backports:SLE-15-SP4 / python-Django - openSUSE:Factory / python-Django - openSUSE:Leap:15.2 / python-Django1 (EOL by the time of the CRD) - openSUSE:Backports:SLE-15-SP2 / python-Django1 (EOL by the time of the CRD) - openSUSE:Backports:SLE-15-SP3 / python-Django1 - openSUSE:Backports:SLE-15-SP4 / python-Django1
Fergal will look into this for the Cloud repos - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update / python-Django - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update / python-Django1
4.0.1 is already in dlpd and in its way to factory
SUSE:SLE-12-SP3:Update:Products:Cloud8:Update / python-Django: * https://build.suse.de/request/show/261771 SUSE:SLE-12-SP4:Update:Products:Cloud9:Update / python-Django1 * https://build.suse.de/request/show/261772
SUSE-SU-2022:0102-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1194115,1194116,1194117 CVE References: CVE-2021-45115,CVE-2021-45116,CVE-2021-45452 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): python-Django-1.11.29-3.33.1 SUSE OpenStack Cloud 8 (src): python-Django-1.11.29-3.33.1 HPE Helion Openstack 8 (src): python-Django-1.11.29-3.33.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0103-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1194115,1194116,1194117 CVE References: CVE-2021-45115,CVE-2021-45116,CVE-2021-45452 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): python-Django1-1.11.29-3.30.1 SUSE OpenStack Cloud 9 (src): python-Django1-1.11.29-3.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SOC updates released, back to security team.
Done, closing.