An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade tfm-rubygem-unfUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-runtimeUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_extUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-netrcUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-powerbarUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-localeUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-rest-clientUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-domain_nameUpgrade rubygem-hashieUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-unfUpgrade rubygem-mime-typesUpgrade rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade rubygem-loggingUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-unicode-debuginfoUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-domain_nameUpgrade rubygem-highlineUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-oauthUpgrade rubygem-little-pluggerUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-hashie | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 7, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py37-django32Upgrade py38-django22Upgrade py38-django32Upgrade py37-django40Upgrade py37-django22Upgrade py39-django40Upgrade py39-django32Upgrade py39-django22Upgrade py38-django40 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade rubygem-rest-clientUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-little-pluggerUpgrade foreman-cliUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hashieUpgrade rubygem-clampUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade rubygem-localeUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-oauthUpgrade rubygem-unf_extUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-mime-typesUpgrade rubygem-netrcUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-runtimeUpgrade tfm-rubygem-multi_jsonUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-powerbarUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-amazing_printUpgrade tfm-rubygem-loggingUpgrade rubygem-mime-typesUpgrade tfm-rubygem-amazing_printUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-clampUpgrade rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade rubygem-unfUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unfUpgrade rubygem-http-cookieUpgrade rubygem-unicodeUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_webhooks | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfo | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub