CVE-2020-15225 Information

Description

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0 automatically generated NumberFilter instances whose value was later converted to an integer were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a MaxValueValidator with a a default limit_value of 1e50 to the form field used by NumberFilter instances. In addition NumberFilter implements the new get_max_validator() which should return a configured validator instance to customise the limit or else None to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Reference

https://github.com/carltongibson/django-filter/security/advisories/GHSA-x7gm-rfgv-w973 https://github.com/carltongibson/django-filter/commit/340cf7a23a2b3dcd7183f6a0d6c383e85b130d2b https://pypi.org/project/django-filter/ https://github.com/carltongibson/django-filter/releases/tag/2.4.0 https://security.netapp.com/advisory/ntap-20210604-0010/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPHENTRHRAYFXYPPBT7JRHZRWILRY44S/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAT2ZAEF6DM3VFSOHKB7X3ASSHGQHJAK/

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

6.5