[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAJVoTUugFyJTPx6wGkzDPFpeXv_HujZ44tPeFG4YvtN_zYLbmA@mail.gmail.com>
Date: Wed, 5 Nov 2025 12:19:41 -0300
From: Natalia Bidart <nataliabidart@...ngoproject.com>
To: oss-security@...ts.openwall.com
Cc: Django Security Team <security@...ngoproject.com>
Subject: Django CVE-2025-64458 and CVE-2025-64459
* Announce:
https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
* JSON Record for CVE-2025-64458:
https://www.cve.org/CVERecord?id=CVE-2025-64458
* JSON Record for CVE-2025-64459:
https://www.cve.org/CVERecord?id=CVE-2025-64459
In accordance with `our security release policy
<https://docs.djangoproject.com/en/dev/internals/security/>`_, the Django
team
is issuing releases for
`Django 5.2.8 <https://docs.djangoproject.com/en/dev/releases/5.2.8/>`_,
`Django 5.1.14 <https://docs.djangoproject.com/en/dev/releases/5.1.14/>`_,
and
`Django 4.2.26 <https://docs.djangoproject.com/en/dev/releases/4.2.26/>`_.
These releases address the security issues detailed below. We encourage all
users of Django to upgrade as soon as possible.
CVE-2025-64458: Potential denial-of-service vulnerability in
``HttpResponseRedirect`` and ``HttpResponsePermanentRedirect`` on Windows
======================================================================================================================================
`NFKC normalization <
https://docs.python.org/3/library/unicodedata.html#unicodedata.normalize>`_
in Python is slow on Windows. As a consequence, ``HttpResponseRedirect``,
``HttpResponsePermanentRedirect``, and ``redirect`` were subject to a
potential denial-of-service attack
via certain inputs with a very large number of Unicode characters.
Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.
This issue has severity "moderate" according to the Django security policy.
CVE-2025-64459: Potential SQL injection via ``_connector`` keyword argument
in ``QuerySet`` and ``Q`` objects
=============================================================================================================
The methods ``QuerySet.filter()``, ``QuerySet.exclude()``, and
``QuerySet.get()``,
and the class ``Q()`` were subject to SQL injection when using a suitably
crafted
dictionary, with dictionary expansion, as the ``_connector`` argument.
Thanks to cyberstan for the report.
This issue has severity "high" according to the Django security policy.
Affected supported versions
===========================
* Django main
* Django 6.0 (currently at beta status)
* Django 5.2
* Django 5.1
* Django 4.2
Resolution
==========
Patches to resolve the issue have been applied to Django's
main, 6.0 (currently at beta status), 5.2, 5.1, and 4.2 branches.
The patches may be obtained from the following changesets.
CVE-2025-64458: Potential denial-of-service vulnerability in
``HttpResponseRedirect`` and ``HttpResponsePermanentRedirect`` on Windows
--------------------------------------------------------------------------------------------------------------------------------------
* On the `main branch <
https://github.com/django/django/commit/c880530ddd4fabd5939bab0e148bebe36699432a
>`__
* On the `6.0 branch <
https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
>`__
* On the `5.2 branch <
https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
>`__
* On the `5.1 branch <
https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
>`__
* On the `4.2 branch <
https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
>`__
CVE-2025-64459: Potential SQL injection via ``_connector`` keyword argument
in ``QuerySet`` and ``Q`` objects
-------------------------------------------------------------------------------------------------------------
* On the `main branch <
https://github.com/django/django/commit/98e642c69181c942d60a10ca0085d48c6b3068bb
>`__
* On the `6.0 branch <
https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
>`__
* On the `5.2 branch <
https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
>`__
* On the `5.1 branch <
https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
>`__
* On the `4.2 branch <
https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
>`__
The following releases have been issued
=======================================
* Django 5.2.8 (`download Django 5.2.8
<https://www.djangoproject.com/download/5.2.8/tarball/>`_ |
`5.2.8 checksums
<https://www.djangoproject.com/download/5.2.8/checksum/>`_)
* Django 5.1.14 (`download Django 5.1.14
<https://www.djangoproject.com/download/5.1.14/tarball/>`_ |
`5.1.14 checksums
<https://www.djangoproject.com/download/5.1.14/checksum/>`_)
* Django 4.2.26 (`download Django 4.2.26
<https://www.djangoproject.com/download/4.2.26/tarball/>`_ |
`4.2.26 checksums
<https://www.djangoproject.com/download/4.2.26/checksum/>`_)
The PGP key ID used for this release is Natalia Bidart: `2EE82A8D9470983E <
https://github.com/nessita.gpg>`_
General notes regarding security reporting
==========================================
As always, we ask that potential security issues be reported via private
email
to ``security@...ngoproject.com``, and not via Django's Trac instance, nor
via
the Django Forum. Please see `our security policies
<https://www.djangoproject.com/security/>`_ for further information.
Content of type "text/html" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
