Ubuntu 21.10: USN-5204-1 Critical Django Security Advisory

ubuntu

January 5, 2022

Several security issues were fixed in Django.

Summary

Several security issues were fixed in Django.

Software Description:

- python-django: High-level Python web development framework

Details:

Chris Bailey discovered that Django incorrectly handled evaluating

submitted passwords. A remote attacker could possibly use this issue to

consume resources, resulting in a denial of service. (CVE-2021-45115)

Dennis Brinkrolf discovered that Django incorrectly handled the dictsort

template filter. A remote attacker could possibly use this issue to obtain

sensitive information. (CVE-2021-45116)

Dennis Brinkrolf discovered that Django incorrectly handled certain file

names. A remote attacker could possibly use this issue to save files to

arbitrary filesystem locations. (CVE-2021-45452)

Topics Covered

security advisory denial of service critical file overwrite information disclosure ubuntu python django

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  python3-django                  2:2.2.24-1ubuntu1.2

Ubuntu 21.04:
  python3-django                  2:2.2.20-1ubuntu0.4

Ubuntu 20.04 LTS:
  python3-django                  2:2.2.12-1ubuntu0.9

Ubuntu 18.04 LTS:
  python-django                   1:1.11.11-1ubuntu1.15
  python3-django                  1:1.11.11-1ubuntu1.15

In general, a standard system update will make all the necessary changes.