An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_katelloUpgrade rubygem-loggingUpgrade rubygem-unicodeUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-unicode-debugsourceUpgrade rubygem-highlineUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-domain_nameUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-fast_gettextUpgrade rubygem-unicode-debuginfoUpgrade rubygem-amazing_printUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-localeUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-little-pluggerUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unfUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cloneUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-jwtUpgrade tfm-runtimeUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-netrcUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-foreman_maintainUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-amazing_printUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-oauthUpgrade rubygem-mime-typesUpgrade rubygem-domain_nameUpgrade tfm-rubygem-rest-clientUpgrade satellite-maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-hashieUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade foreman-cliUpgrade tfm-rubygem-netrc | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 7, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py38-django40Upgrade py39-django32Upgrade py39-django40Upgrade py37-django40Upgrade py37-django22Upgrade py39-django22Upgrade py38-django22Upgrade py38-django32Upgrade py37-django32 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-highlineUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-unf_extUpgrade tfm-rubygem-unicode-debuginfoUpgrade satellite-maintainUpgrade tfm-rubygem-unicodeUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-oauthUpgrade rubygem-localeUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-rest-clientUpgrade foreman-cliUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hashieUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-clampUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unfUpgrade rubygem-little-pluggerUpgrade satellite-cloneUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-loggingUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-multi_jsonUpgrade rubygem-loggingUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-powerbarUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade satellite-cliUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-http-cookieUpgrade rubygem-http-cookieUpgrade rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-mime-typesUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-jwtUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-fast_gettextUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-domain_nameUpgrade tfm-rubygem-clampUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_tasks | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub