Skip to content
OpenAdvisories
High USN-5549-1 1 CVE

python-django vulnerability

Published Aug 4, 2022 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Django incorrectly handled certain FileResponse.
An attacker could possibly use this issue to expose sensitive information
or gain access over user machine.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS python-django 2:2.2.12-1ubuntu0.13
Ubuntu · 22.04 LTS 22.04:LTS python-django 2:3.2.12-2ubuntu1.2

Vulnerabilities 1

  • High 8.8
    CVE-2022-36359

    Django vulnerable to Reflected File Download attack

    An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is der…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2022-36359