An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-unf_extUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-powerbarUpgrade rubygem-oauthUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-loggingUpgrade rubygem-loggingUpgrade rubygem-unicodeUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hashieUpgrade rubygem-localeUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-highlineUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-amazing_printUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-oauthUpgrade tfm-runtimeUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cloneUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-mime-typesUpgrade rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-domain_nameUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-rest-clientUpgrade satellite-maintainUpgrade rubygem-hashieUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade rubygem-http-cookieUpgrade tfm-rubygem-highlineUpgrade rubygem-unfUpgrade tfm-rubygem-unicode | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 7, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py38-django32Upgrade py38-django22Upgrade py37-django32Upgrade py37-django40Upgrade py37-django22Upgrade py38-django40Upgrade py39-django22Upgrade py39-django32Upgrade py39-django40 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-unicode-display_widthUpgrade satellite-maintainUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-highlineUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-netrcUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hashieUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hashieUpgrade tfm-rubygem-unicodeUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-mime-typesUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-rest-clientUpgrade foreman-cliUpgrade rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-netrcUpgrade rubygem-multi_jsonUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unfUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-amazing_printUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-fast_gettextUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debuginfoUpgrade rubygem-mime-typesUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-loggingUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-domain_nameUpgrade tfm-rubygem-http-cookieUpgrade rubygem-unicodeUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unfUpgrade rubygem-http-cookieUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-runtimeUpgrade rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debugsource | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub