python-django - security update

Fixed packages 1

Vulnerabilities 5

• Critical 9.8
  CVE-2022-34265 Public exploit EPSS 74%

  Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

  An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind cho…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jul 4, 2022
• High 7.5
  CVE-2020-24583

  Django Incorrect Default Permissions

  An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Sep 1, 2020
• High 7.5
  CVE-2020-24584

  Django Incorrect Default Permissions

  An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Sep 1, 2020
• Medium 5.9
  CVE-2021-23336 EPSS 41%

  Web Cache Poisoning

  The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…

  python-django python-django python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  Feb 15, 2021
• Medium 5.3
  CVE-2021-3281 Public exploit

  Django Directory Traversal via archive.extract

  In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with do…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Feb 2, 2021