mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2021-45116 -- Fixed potential information disclosure in dictsort template filter.

Browse Source 
Thanks to Dennis Brinkrolf for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
This commit is contained in:
Florian Apolloner
2021-12-27 14:53:18 +01:00
committed by Carlton Gibson
parent 968a3d01fa
commit 761f449e0d
7 changed files with 135 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/releases/3.2.11.txt
View File

@@ -20,3 +20,19 @@ In order to mitigate this issue, relatively long values are now ignored by
This issue has severity "medium" according to the :ref:`Django security policy
<security-disclosure>`.
CVE-2021-45116: Potential information disclosure in ``dictsort`` template filter
================================================================================
Due to leveraging the Django Template Language's variable resolution logic, the
:tfilter:`dictsort` template filter was potentially vulnerable to information
disclosure or unintended method calls, if passed a suitably crafted key.
In order to avoid this possibility, ``dictsort`` now works with a restricted
resolution logic, that will not call methods, nor allow indexing on
dictionaries.
As a reminder, all untrusted user input should be validated before use.
This issue has severity "low" according to the :ref:`Django security policy
<security-disclosure>`.