An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-http-cookieUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-cloneUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade rubygem-hashieUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-unfUpgrade rubygem-mime-typesUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-mime-typesUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade satellite-maintainUpgrade tfm-rubygem-rest-clientUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-unfUpgrade rubygem-http-cookieUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-highlineUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-multi_jsonUpgrade tfm-runtimeUpgrade rubygem-localeUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-jwtUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hashieUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade rubygem-rest-clientUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-oauthUpgrade rubygem-little-pluggerUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-highlineUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-unicode | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 7, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py37-django32Upgrade py38-django32Upgrade py38-django22Upgrade py38-django40Upgrade py39-django40Upgrade py39-django22Upgrade py39-django32Upgrade py37-django22Upgrade py37-django40 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_katelloUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-oauthUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade rubygem-highlineUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-netrcUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hashieUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade rubygem-localeUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-amazing_printUpgrade rubygem-amazing_printUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-unicode-debuginfoUpgrade satellite-cliUpgrade rubygem-powerbarUpgrade rubygem-unfUpgrade rubygem-little-pluggerUpgrade tfm-runtimeUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-domain_nameUpgrade rubygem-jwtUpgrade tfm-rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unfUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-apipie-bindingsUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade tfm-rubygem-unf_extUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-oauthUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-jwtUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_admin | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfo | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub