Summary
Dan Palmer discovered that Django incorrectly validated memcached cache
keys. A remote attacker could possibly use this issue to cause a denial of
service and obtain sensitive information. (CVE-2020-13254)
Jon Dufresne discovered that Django incorrectly encoded query parameters
for the admin ForeignKeyRawIdWidget. A remote attacker could possibly use
this issue to perform XSS attacks. (CVE-2020-13596)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | python-django | 1.8.7-1ubuntu5.13 |
| Ubuntu · 18.04 LTS 18.04:LTS | python-django | 1:1.11.11-1ubuntu1.9 |
| Ubuntu · 20.04 LTS 20.04:LTS | python-django | 2:2.2.12-1ubuntu0.1 |
Vulnerabilities 2
-
Medium 6.1
XSS in Django
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
-
Medium 5.9CVE-2020-13254 Public exploit
Data leakage via cache key collision in Django
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.