Skip to content
OpenAdvisories
Critical DLA-3177-1 3 CVEs

python-django - security update

Published Nov 4, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 python-django 1:1.11.29-1+deb10u3

Vulnerabilities 3

  • Critical 9.8
    CVE-2022-28346 Public exploit EPSS 19%

    SQL Injection in Django

    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2021-45115

    Denial-of-service in Django

    An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. I…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2021-45116

    Information disclosure in Django

    An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an …

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI