Description
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 2:2.2.16-1 | — |
| Debian 13 | python-django | 2:2.2.16-1 | — |
| Debian 12 | python-django | 2:2.2.16-1 | — |
| Debian 10 | python-django | 1:1.11.29-1+deb10u2 | DLA-3164-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.2 | USN-4479-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Django | 3.2.7-2.3 | openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 | openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 | openSUSE-SU-2026:11270-1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 | openSUSE-SU-2026:10005-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-django | 3.1.1-r0 | — |
| Alpine v3.23 | py3-django | 3.1.1-r0 | — |
| Alpine v3.22 | py3-django | 3.1.1-r0 | — |
| Alpine v3.21 | py3-django | 3.1.1-r0 | — |
| Alpine v3.20 | py3-django | 3.1.1-r0 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-django | 3.1.1-r0 | — |
| Alpine v3.18 | py3-django | 3.1.1-r0 | — |
| Alpine v3.17 | py3-django | 3.1.1-r0 | — |
| Alpine v3.16 | py3-django | 3.1.1-r0 | — |
| Alpine v3.15 | py3-django | 3.1.1-r0 | — |
| Alpine v3.14 | py3-django | 3.1.1-r0 | — |
| Alpine v3.13 | py3-django | 3.1.1-r0 | — |
| Alpine v3.12 | py3-django | 1.11.29-r1 | — |
| Alpine v3.11 | py3-django | 1.11.29-r1 | — |
| Alpine v3.10 | py-django | 1.11.29-r1 | — |
| Alpine v3.9 | py-django | 1.11.29-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 2.2, < 2.2.16 | 2.2.16 | GHSA-fr28-569j-53c4 |
| PyPI | django | >= 3.0, < 3.0.10 | 3.0.10 | GHSA-fr28-569j-53c4 |
| PyPI | django | >= 3.1, < 3.1.1 | 3.1.1 | GHSA-fr28-569j-53c4 |
| PyPI | django | >= 2.2, < 2.2.16 · >= 3.0, < 3.0.10 · >= 3.1, < 3.1.1 | 2.2.16, 3.0.10, 3.1.1 | PYSEC-2020-34 |
Advisories 9
- openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
- openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
- openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-3164-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4479-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://docs.djangoproject.com/en/dev/releases/security/
- USN-4479-1 vendor-advisory
- FEDORA-2020-94407454d7 vendor-advisory
- FEDORA-2020-6941c0a65b vendor-advisory
- FEDORA-2020-9c6b391162 vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://groups.google.com/forum/#%21topic/django-announce/zFCMdgUnutU
- https://groups.google.com/forum/#%21topic/django-announce/Gdqn58RqIDM
- https://www.openwall.com/lists/oss-security/2020/09/01/2
- https://www.djangoproject.com/weblog/2020/sep/01/security-releases/
- https://security.netapp.com/advisory/ntap-20200918-0004/