CVE-2020-15225 Denial of Service vulnerability in django-filter
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2020-15225?
CVE-2020-15225 is a high-severity vulnerability in Fedoraproject Fedora, published on 29 Apr 2021.
Official description
django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.
Weakness: CWE-681
Which versions are affected by CVE-2020-15225?
3 open source packages ship an affected version, including django-filter. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
django-filter PyPI | All versions | 2.4.0 |
django-filter PyPI | All versions | 2.4.0 |
django-filter PyPI | All versions | 2.4.0 |
Products include Django-Filter Project Django-Filter, Fedoraproject Fedora.
How do I fix CVE-2020-15225?
Upgrade django-filter to 2.4.0 or later.
Is CVE-2020-15225 being exploited?
There is no known exploitation of CVE-2020-15225 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-15225, GHSA-x7gm-rfgv-w973, MGASA-2021-0511, PYSEC-2021-64, UBUNTU-CVE-2020-15225.