Debian LTS: DLA-3164-1: python-django security update | LinuxSecuri...

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3164-1                [email protected]
https://www.debian.org/lts/security/                           Chris Lamb
October 28, 2022                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : python-django
Version        : 1:1.11.29-1+deb10u2
CVE IDs        : CVE-2020-24583 CVE-2020-24584 CVE-2021-3281
                 CVE-2021-23336 CVE-2022-34265
Debian Bugs    : 969367 981562 983090 1014541

Multiple vulnerabilities were discovered in Django, a popular
Python-based web development framework:

 * CVE-2020-24583: Fix incorrect permissions on intermediate-level
   directories on Python 3.7+. FILE_UPLOAD_DIRECTORY_PERMISSIONS mode
   was not applied to intermediate-level directories created in the
   process of uploading files and to intermediate-level collected
   static directories when using the collectstatic management
   command. You should review and manually fix permissions on
   existing intermediate-level directories.

 * CVE-2020-24584: Correct permission escalation vulnerability in
   intermediate-level directories of the file system cache. On Python
   3.7 and above, the intermediate-level directories of the file
   system cache had the system's standard umask rather than 0o077 (no
   group or others permissions).

 * CVE-2021-3281: Fix a potential directory-traversal exploit via
   archive.extract(). The django.utils.archive.extract() function,
   used by startapp --template and startproject --template, allowed
   directory traversal via an archive with absolute paths or relative
   paths with dot segments.

 * CVE-2021-23336: Prevent a web cache poisoning attack via "parameter
   cloaking". Django contains a copy of urllib.parse.parse_qsl()
   which was added to backport some security fixes. A further
   security fix has been issued recently such that parse_qsl() no
   longer allows using ";" as a query parameter separator by default.

 * CVE-2022-34265: The Trunc() and Extract() database functions were
   subject to a potential SQL injection attach if untrusted data was
   used as a value for the "kind" or "lookup_name" parameters.
   Applications that constrain the choice to a known safe list were
   unaffected.

For Debian 10 buster, these problems have been fixed in version
1:1.11.29-1+deb10u2.

We recommend that you upgrade your python-django packages.

For the detailed security status of python-django please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-django

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Debian LTS: DLA-3164-1: python-django security update

October 28, 2022

Summary

* CVE-2020-24583: Fix incorrect permissions on intermediate-level
directories on Python 3.7+. FILE_UPLOAD_DIRECTORY_PERMISSIONS mode
was not applied to intermediate-level directories created in the
process of uploading files and to intermediate-level collected
static directories when using the collectstatic management
command. You should review and manually fix permissions on
existing intermediate-level directories.

* CVE-2020-24584: Correct permission escalation vulnerability in
intermediate-level directories of the file system cache. On Python
3.7 and above, the intermediate-level directories of the file
system cache had the system's standard umask rather than 0o077 (no
group or others permissions).

* CVE-2021-3281: Fix a potential directory-traversal exploit via
archive.extract(). The django.utils.archive.extract() function,
used by startapp --template and startproject --template, allowed
directory traversal via an archive with absolute paths or relative
paths with dot segments.

* CVE-2021-23336: Prevent a web cache poisoning attack via "parameter
cloaking". Django contains a copy of urllib.parse.parse_qsl()
which was added to backport some security fixes. A further
security fix has been issued recently such that parse_qsl() no
longer allows using ";" as a query parameter separator by default.

* CVE-2022-34265: The Trunc() and Extract() database functions were
subject to a potential SQL injection attach if untrusted data was
used as a value for the "kind" or "lookup_name" parameters.
Applications that constrain the choice to a known safe list were
unaffected.

For Debian 10 buster, these problems have been fixed in version
1:1.11.29-1+deb10u2.

We recommend that you upgrade your python-django packages.

For the detailed security status of python-django please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-django

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
Package : python-django
Version : 1:1.11.29-1+deb10u2

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.