An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hashieUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-mime-typesUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-maintainUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unicodeUpgrade foreman-cliUpgrade satellite-cloneUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-netrcUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hammer_cli_foremanUpgrade tfm-runtimeUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade satellite-cliUpgrade tfm-rubygem-amazing_printUpgrade rubygem-http-cookieUpgrade rubygem-highlineUpgrade rubygem-amazing_printUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-oauthUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-unicode | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 7, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py37-django32Upgrade py38-django32Upgrade py38-django22Upgrade py39-django32Upgrade py39-django22Upgrade py39-django40Upgrade py37-django22Upgrade py38-django40Upgrade py37-django40 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-powerbarUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-loggingUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-jwtUpgrade rubygem-domain_nameUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-clampUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-http-cookieUpgrade rubygem-http-cookieUpgrade rubygem-jwtUpgrade rubygem-amazing_printUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade rubygem-little-pluggerUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-mime-typesUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade foreman-cliUpgrade rubygem-highlineUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-clampUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hashieUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-netrcUpgrade rubygem-rest-clientUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-localeUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_tasks | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfo | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub