Debian Long Term Support / LTS Security Information / 2022 / Security Information -- DLA-2906-1 python-django

Debian Security Advisory

DLA-2906-1 python-django -- LTS security update

Date Reported:

01 Feb 2022

Affected Packages:

python-django

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2022-22818, CVE-2022-23833.

More information:

It was discovered that there were two vulnerabilities in Django, a popular Python-based web development framework:

• CVE-2022-22818

  Possible XSS via {% debug %} template tag.

  The {% debug %} template tag didn't properly encode the current context, posing an XSS attack vector.

  In order to avoid this vulnerability, {% debug %} no longer outputs information when the DEBUG setting is False, and it ensures all context variables are correctly escaped when the DEBUG setting is True.

• CVE-2022-23833

  Denial-of-service possibility in file uploads

  Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

For Debian 9 Stretch, these problems have been fixed in version 1:1.10.7-2+deb9u15.

We recommend that you upgrade your python-django packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS