{
  "cveId": "CVE-2025-13372",
  "url": "https://patchblox.com/security/cve/CVE-2025-13372",
  "summary": "CVE-2025-13372 is fixed in 3 products on 1 platform, first by python3-django 2:2.2.12-1ubuntu0.29\u002Besm6, released December 2, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python3-django: An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27",
  "description": "An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. \u0060FilteredRelation\u0060 is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the \u0060**kwargs\u0060 passed to \u0060QuerySet.annotate()\u0060 or \u0060QuerySet.alias()\u0060 on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.",
  "published": "2025-12-02T06:00:00Z",
  "severity": "Medium",
  "cvss": 4.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
  "epss": 0.00926,
  "epssPercentile": 0.60704,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "4.2.11-150600.3.44.1",
      "fix": "SUSE-SU-2025:4384-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4384-1",
      "released": "2025-12-12T13:28:27Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.2.4-bp160.4.1",
      "fix": "OPENSUSE-SU-2025:20153-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20153-1",
      "released": "2025-12-09T13:43:55Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "sles 15.6",
      "fixedVersion": "4.2.11-150600.3.44.1",
      "fix": "SUSE-SU-2025:4384-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4384-1",
      "released": "2025-12-12T13:28:27Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "sles 15.7",
      "fixedVersion": "4.2.11-150600.3.44.1",
      "fix": "SUSE-SU-2025:4384-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4384-1",
      "released": "2025-12-12T13:28:27Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3:3.2.25-0\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2025-13372",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-13372",
      "released": "2025-12-02T16:15:53Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3:4.2.27-0\u002Bdeb13u1",
      "fix": "DSA-6117-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-6117-1",
      "released": "2026-01-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:4.2.27-1",
      "fix": "DEBIAN-CVE-2025-13372",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-13372",
      "released": "2025-12-02T16:15:53Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:2.2.12-1ubuntu0.29\u002Besm6",
      "fix": "python3-django 2:2.2.12-1ubuntu0.29\u002Besm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-django-2-2.2.12-1ubuntu0.29-esm6",
      "released": "2025-12-02T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:3.2.12-2ubuntu1.24",
      "fix": "python3-django 2:3.2.12-2ubuntu1.24",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-django-2-3.2.12-2ubuntu1.24",
      "released": "2025-12-02T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3:4.2.11-1ubuntu1.13",
      "fix": "python3-django 3:4.2.11-1ubuntu1.13",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-django-3-4.2.11-1ubuntu1.13",
      "released": "2025-12-02T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "3:5.2.4-1ubuntu2.2",
      "fix": "python3-django 3:5.2.4-1ubuntu2.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-django-3-5.2.4-1ubuntu2.2",
      "released": "2025-12-02T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "3:5.2.9-0ubuntu1",
      "fix": "python3-django 3:5.2.9-0ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-django-3-5.2.9-0ubuntu1",
      "released": "2025-12-02T06:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}