Summary
Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen, Logeinträge zu manipulieren oder einen Denial of Service zu verursachen.
Product
Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.
Vulnerabilities 6
-
Medium 5.3
Potential memory exhaustion in MultiPartParser via base64-encoded file upload
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-En…
-
Medium 5.3
Potential log injection via unescaped geometry form values
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values befor…
-
Medium 5.3
Server-side request forgery via crs member of GeoJSON geometries
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause ser…
-
Medium 5.3
Server-side request forgery via SpatialReference string input
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing s…
-
Low 3.1
Potential exposure of private data via empty and missing Vary headers
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that om…
-
Low 2.2
Password hash disclosure to "view only" admin users with custom user models
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its…
Revision history
-
#2
Neue Updates von Debian aufgenommen
-
#1
Initiale Fassung
References
-
Django security releases vom 2026-11-03
https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
-
Debian Security Advisory DLA-4903 vom 2026-11-13
https://lists.debian.org/debian-lts-announce/2026/11/msg00028.html