python-django - security update

Fixed packages 2

Vulnerabilities 2

• Medium 6.1
  CVE-2020-13596

  XSS in Django

  An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jun 3, 2020
• Medium 5.9
  CVE-2020-13254 Public exploit

  Data leakage via cache key collision in Django

  An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jun 3, 2020