An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-oauthUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unfUpgrade tfm-rubygem-netrcUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-mime-typesUpgrade satellite-cliUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hashieUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade satellite-maintainUpgrade tfm-rubygem-rest-clientUpgrade rubygem-apipie-bindingsUpgrade rubygem-domain_nameUpgrade rubygem-mime-typesUpgrade tfm-runtimeUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debuginfoUpgrade satellite-cloneUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-oauthUpgrade rubygem-clampUpgrade rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-unicodeUpgrade tfm-rubygem-unf_extUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-domain_nameUpgrade rubygem-highlineUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-fast_gettextUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_execution | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 7, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py38-django40Upgrade py37-django22Upgrade py39-django22Upgrade py39-django32Upgrade py39-django40Upgrade py37-django40Upgrade py37-django32Upgrade py38-django22Upgrade py38-django32 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-netrcUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-rest-clientUpgrade tfm-rubygem-netrcUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade rubygem-hashieUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-unicodeUpgrade rubygem-localeUpgrade rubygem-unicodeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-powerbarUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-little-pluggerUpgrade satellite-cloneUpgrade rubygem-fast_gettextUpgrade tfm-runtimeUpgrade satellite-cliUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-clampUpgrade rubygem-jwtUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-domain_nameUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unfUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-jwtUpgrade rubygem-loggingUpgrade rubygem-mime-typesUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-loggingUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-http-cookieUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-powerbar | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub