An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-rest-clientUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade rubygem-unicodeUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hashieUpgrade rubygem-clampUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-oauthUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-netrcUpgrade rubygem-http-cookieUpgrade tfm-rubygem-amazing_printUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-maintainUpgrade rubygem-netrcUpgrade rubygem-hashieUpgrade rubygem-mime-typesUpgrade rubygem-domain_nameUpgrade tfm-rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cloneUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-highlineUpgrade rubygem-unfUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-runtimeUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-clampUpgrade rubygem-apipie-bindings | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 7, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py38-django32Upgrade py37-django32Upgrade py38-django22Upgrade py37-django22Upgrade py39-django22Upgrade py38-django40Upgrade py37-django40Upgrade py39-django40Upgrade py39-django32 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-mime-types-dataUpgrade rubygem-oauthUpgrade rubygem-rest-clientUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-domain_nameUpgrade foreman-cliUpgrade rubygem-netrcUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-rest-clientUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unicodeUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-loggingUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-fast_gettextUpgrade rubygem-little-pluggerUpgrade rubygem-domain_nameUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unfUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-jwtUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cliUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-runtimeUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unfUpgrade rubygem-unicodeUpgrade rubygem-http-cookie | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfo | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub