The Django development team has released updates for versions 6.0.8 and 5.2.17 to address four security vulnerabilities in supported Python web frameworks. Developers are advised to upgrade their systems as soon as possible, particularly if using Django's GIS features or the built-in admin interface with staff users. This issue affects Django spatial lookups that process raster-related values through GDALRaster.
Depending on the chosen raster driver, a malicious value might trigger file writes on the server or initiate network requests with the permissions of the Django process. The function, which stores large numbers of distinct and excessively long language codes in an in-memory cache, could potentially consume significant memory when attacked by an attacker via POST requests to the optional set_language() view.
The update now truncates language codes exceeding 500 characters before they reach the cached lookup, reducing unnecessary memory usage. Deeply nested GEOMETRYCOLLECTION objects can lead to segmentation faults in the underlying GEOS library, potentially disrupting Django applications if attackers use crafted geometry input for spatial field lookups or GeometryField form fields. For GeoJSON inputs, developers can use the new max_geom_collections setting within GEOSGeometry or related form fields and model fields to adjust the threshold as needed.
URLField entries were incorrectly interpreted as clickable links in changelists and read-only admin fields, leading to potential security risks when using unsafe schemes.
