CVE-2025-48432
Fixed in a distro release EPSS <1%CVSS 4.0
An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 5.2.2 |
| PyPI | django | 5.1.10 |
| PyPI | django | 4.2.22 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | awx | 24.6.1-r8 |
| Debian:11 | python-django | 2:2.2.28-1~deb11u7 |
| Debian:12 | python-django | 3:3.2.25-0+deb12u1 |
| Debian:13 | python-django | 3:4.2.23-1 |
| Debian:14 | python-django | 3:4.2.23-1 |
| Red Hat:ansible_automation_platform:2.5 | automation-controller | 0:4.6.19-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller | 0:4.6.19-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-cli | 0:4.6.19-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-cli | 0:4.6.19-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-server | 0:4.6.19-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-server | 0:4.6.19-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-ui | 0:4.6.19-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-ui | 0:4.6.19-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-venv-tower | 0:4.6.20-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-venv-tower | 0:4.6.20-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-venv-tower | 0:4.6.19-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | automation-controller-venv-tower | 0:4.6.19-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-django | 0:4.2.24-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-django | 0:4.2.23-1.el8ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-django | 0:4.2.24-1.el9ap |
| Red Hat:ansible_automation_platform:2.5 | python3.11-django | 0:4.2.23-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.5 | automation-controller | 0:4.6.19-1.el8ap |
| Red Hat:ansible_automation_platform_developer:2.5 | automation-controller | 0:4.6.19-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.5 | automation-controller-cli | 0:4.6.19-1.el8ap |
| Red Hat:ansible_automation_platform_developer:2.5 | automation-controller-cli | 0:4.6.19-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.5 | python3.11-django | 0:4.2.23-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.5 | python3.11-django | 0:4.2.24-1.el9ap |
| Red Hat:ansible_automation_platform_developer:2.5 | python3.11-django | 0:4.2.24-1.el8ap |
| Red Hat:ansible_automation_platform_developer:2.5 | python3.11-django | 0:4.2.23-1.el8ap |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.24.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.27.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python-Django | 4.2.11-150600.3.27.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python-Django | 4.2.11-150600.3.24.1 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.19 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.20 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.8 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.9 |
| Ubuntu:25.10 | python-django | 3:5.2.4-1 |
| Ubuntu:Pro:14.04:LTS | python-django | no fix |
| Ubuntu:Pro:16.04:LTS | python-django | no fix |
| Ubuntu:Pro:18.04:LTS | python-django | no fix |
| Ubuntu:Pro:20.04:LTS | python-django | 2:2.2.12-1ubuntu0.29+esm2 |
| Ubuntu:Pro:20.04:LTS | python-django | 2:2.2.12-1ubuntu0.29+esm1 |
| openSUSE:Leap 15.6 | python-Django | 4.2.11-150600.3.24.1 |
| openSUSE:Leap 15.6 | python-Django | 4.2.11-150600.3.27.1 |
| openSUSE:Tumbleweed | python-Django | 5.2.2-1.1 |
| openSUSE:Tumbleweed | python-Django4 | 4.2.22-1.1 |
| openSUSE:Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE:Tumbleweed | python-Django6 | 6.0-1.1 |