Summary
It was discovered that Django incorrectly handled certain characters in the
FilteredRelation object. An attacker could possibly use this issue to
execute arbitrary SQL commands. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
(CVE-2025-13372)
Seokchan Yoon discovered that Django inefficiently handled deserialization
of XML objects. An attacker could possibly use this issue to cause Django
to use excessive resources, causing a denial of service. (CVE-2025-64460)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python-django | 2:3.2.12-2ubuntu1.24 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-django | 3:4.2.11-1ubuntu1.13 |
| Ubuntu · 25.10 | python-django | 3:5.2.4-1ubuntu2.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python-django | 1.6.11-0ubuntu1.3+esm9 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-django | 1.8.7-1ubuntu5.15+esm10 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-django | 1:1.11.11-1ubuntu1.21+esm13 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-django | 2:2.2.12-1ubuntu0.29+esm6 |
Vulnerabilities 2
-
High 7.5
Potential denial-of-service vulnerability in XML serializer text extraction
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and …
-
Medium 4.3
Potential SQL injection in FilteredRelation column aliases on PostgreSQL
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.anno…