=====================================================================

                           CERT-Renater

                 Note d'Information No. 2022/VULN001
_____________________________________________________________________

DATE                : 04/01/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Django versions prior to 4.0.1,

                     3.2.11, and 2.2.26

=====================================================================
https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
_____________________________________________________________________


Django security releases issued: 4.0.1, 3.2.11, and 2.2.26
Posted by Carlton Gibson on janvier 4, 2022
In accordance with our security release policy, the Django team is
issuing Django 4.0.1, Django 3.2.11, and Django 2.2.26. These release
addresses the security issues detailed below. We encourage all users of
Django to upgrade as soon as possible.

CVE-2021-45115: Denial-of-service possibility in
UserAttributeSimilarityValidator
UserAttributeSimilarityValidator incurred significant overhead
evaluating submitted password that were artificially large in relative
to the comparison values. On the assumption that access to user
registration was unrestricted this provided a potential vector for a
denial-of-service attack.

In order to mitigate this issue, relatively long values are now ignored
by UserAttributeSimilarityValidator.

Thanks Chris Bailey for the report.

This issue has severity "medium" according to the Django security policy.

CVE-2021-45116: Potential information disclosure in dictsort template filter
Due to leveraging the Django Template Language's variable resolution
logic, the dictsort template filter was potentially vulnerable to
information disclosure or unintended method calls, if passed a suitably
crafted key.

In order to avoid this possibility, dictsort now works with a restricted
resolution logic, that will not call methods, nor allow indexing on
dictionaries.

As a reminder, all untrusted user input should be validated before use.

Thanks to Dennis Brinkrolf for the report.

This issue has severity "low" according to the Django security policy.

CVE-2021-45452: Potential directory-traversal via Storage.save()
Storage.save() allowed directory-traversal if directly passed suitably
crafted file names.

Thanks to Dennis Brinkrolf for the report.

This issue has severity "low" according to the Django security policy.

Affected supported versions
Django main branch
Django 4.0
Django 3.2
Django 2.2
Resolution
Patches to resolve the issue have been applied to Django's main branch
and to the 4.0, 3.2, and 2.2 release branches. The patches may be
obtained from the following changesets.

CVE-2021-45115:

On the main branch
On the 4.0 release branch
On the 3.2 release branch
On the 2.2 release branch
CVE-2021-45116:

On the main branch
On the 4.0 release branch
On the 3.2 release branch
On the 2.2 release branch
CVE-2021-45452:

On the main branch
On the 4.0 release branch
On the 3.2 release branch
On the 2.2 release branch
The following releases have been issued:

Django 4.0.1 (download Django 4.0.1 | 4.0.1 checksums)
Django 3.2.11 (download Django 3.2.11 | 3.2.11 checksums)
Django 2.2.26 (download Django 2.2.26 | 2.2.26 checksums)
The PGP key ID used for these releases is Carlton Gibson: E17DF5C82B4F9D00.

General notes regarding security reporting
As always, we ask that potential security issues be reported via private
email to security@djangoproject.com, and not via Django's Trac instance
or the django-developers list. Please see our security policies for
further information.

=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================