Impact

Automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents.

Patches

Version 2.4.0+ applies a MaxValueValidator with a a default limit_value of 1e50 to the form field used by NumberFilter instances.

In addition, NumberFilter implements the new get_max_validator() which should return a configured validator instance to customise the limit, or else None to disable the additional validation.

Workarounds

Users may manually apply an equivalent validator if they are not able to upgrade.

For more information

If you have any questions or comments about this advisory:

• Open an issue in the django-filter repo

Thanks to Marcin Waraksa for the report.

References

• GHSA-x7gm-rfgv-w973
• carltongibson/django-filter@340cf7a
• https://github.com/carltongibson/django-filter/releases/tag/2.4.0
• https://pypi.org/project/django-filter/
• https://nvd.nist.gov/vuln/detail/CVE-2020-15225
• https://security.netapp.com/advisory/ntap-20210604-0010/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPHENTRHRAYFXYPPBT7JRHZRWILRY44S/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAT2ZAEF6DM3VFSOHKB7X3ASSHGQHJAK/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVJ7AYU6FUSU3F653YCGW5LFD3IULRSX/