CVE-2021-45116: Input Validation
An information-disclosure flaw was found in Django, where the dictsort filter in Django's Template Language did not correctly validate user input. A network attacker could exploit this flaw using a suitably crafted key to force information disclosure or unintended method calls.
Other sources
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
Due to leveraging the Django Template Language's variable resolution logic, the :tfilter:dictsort template filter was potentially vulnerable to information disclosure or unintended method calls, if passed a suitably crafted key.
References:
https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-45116?
CVE-2021-45116 is an information-disclosure vulnerability in Django.
What is the severity of CVE-2021-45116?
The severity of CVE-2021-45116 is high, with a CVSS score of 7.5.
Which versions of Django are affected by CVE-2021-45116?
Django versions before 2.2.26, 3.2.11, and 4.0.1 are affected by CVE-2021-45116.
How can I fix CVE-2021-45116?
To fix CVE-2021-45116, update Django to version 2.2.26, 3.2.11, or 4.0.1.
Where can I find more information about CVE-2021-45116?
You can find more information about CVE-2021-45116 in the official Django documentation and the Django announce mailing list.