Django CVE-2025-57833

Site Operators
1

Hi everyone
I noticed Django released a patch for a critical vulnerability CVE-2025-57833 with potential SQL injection, which was also added to the LTS 4.2.24 release

I also see the platform’s Django version is pinned to <5.0

Does this mean that we’ll automatically get the new security patch or would a rebuild of openedx platform be required in order to pull in the latest patch? Does anyone have any knowledge about how this might potentially be exploited and what areas of the platform might be vulnerable in Openedx/tutor if left unpatched? I’ve done a rebuild recently so expect it should be up to date, this is just a case of curiosity :slight_smile:

2

@feanil could you comment here?

3

Here’s where you can see the current version of Django that gets installed:

So at least on master, we should be on the patched version. (I haven’t checked if this has been backported to other branches.)

1 Like
4

(However, I also don’t see FilteredRelation used anywhere in the codebase, so it might be irrelevant? Not really sure, though – that might take a lot more digging, due to libraries.)

1 Like
5

Thanks @Tim_McCormack,
Looks like it’s only in master and not on Teak.2 just yet, but I also couldn’t find any reference to the FilteredRelation function, I think that sufficiently satisfies my curiosity for now :slight_smile: