An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield() renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. URLField validation through a ModelForm or the admin rejects unsafe schemes, so this affects applications that persist URLField data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.setlanguage are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
End of life: 4/2/2025, End of support: 8/7/2024, Latest version: 5.0.14
End of life: 4/2/2025, End of support: 8/7/2024, Latest version: 5.0.14
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
https://docs.djangoproject.com/en/4.0/releases/security/ https://github.com/django/django/commit/5b6b257fa7ec37ff27965358800c67e2dd11c924 https://www.djangoproject.com/weblog/2022/oct/04/security-releases/ https://groups.google.com/forum/#!forum/django-announce
End of life: 12/1/2023, End of support: 4/5/2023, Latest version: 4.1.13
End of life: 12/1/2023, End of support: 4/5/2023, Latest version: 4.1.13
End of life: 4/1/2023, End of support: 8/3/2022, Latest version: 4.0.10
End of life: 4/1/2023, End of support: 8/3/2022, Latest version: 4.0.10
Running inventories of ~60k hosts no longer takes a very long time for events to show up Removed artifactdata from data sent to analytics as part of playbookonstats, since artifactdata can contain PII or sensitive data Regular users are no longer experiencing longer load times than a superuser when clicking to edit a job template Updated password validation support to allow modifying password complexity requirements using some Django configurations Fixed AWS inventory tags filtering to support the OR condition Updated Ansible version to 2.9.25 Updated Django version to 2.2.20 Fixed Tower's NGINX Instance vulnerability (CVE-2021-23017)
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
A flaw was found in django. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names.
End of life: 4/1/2024, End of support: 12/7/2021, Latest version: 3.2.25
End of life: 4/1/2024, End of support: 12/7/2021, Latest version: 3.2.25
End of life: 12/7/2021, End of support: 4/6/2021, Latest version: 3.1.14
End of life: 12/7/2021, End of support: 4/6/2021, Latest version: 3.1.14
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
End of life: 4/6/2021, End of support: 8/3/2020, Latest version: 3.0.14
End of life: 4/6/2021, End of support: 8/3/2020, Latest version: 3.0.14
django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via jsreverseinline.
End of life: 4/11/2022, End of support: 12/2/2019, Latest version: 2.2.28
End of life: 4/11/2022, End of support: 12/2/2019, Latest version: 2.2.28
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.
End of life: 12/2/2019, End of support: 4/1/2019, Latest version: 2.1.15
End of life: 12/2/2019, End of support: 4/1/2019, Latest version: 2.1.15
End of life: 4/1/2019, End of support: 8/1/2018, Latest version: 2.0.13
End of life: 4/1/2019, End of support: 8/1/2018, Latest version: 2.0.13
End of life: 4/1/2020, End of support: 12/2/2017, Latest version: 1.11.29