diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 40241402d551..09998dc0fa4e 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,60 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + Django -- multiple vulnerabilities + + + py35-django22 + py36-django22 + py37-django22 + py38-django22 + 2.2.16 + + + py36-django30 + py37-django30 + py38-django30 + 3.0.10 + + + py36-django31 + py37-django31 + py38-django31 + 3.1.1 + + + + +

Django Release notes:

+
+

CVE-2020-24583: Incorrect permissions on intermediate-level directories + on Python 3.7+

+

On Python 3.7+, FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied + to intermediate-level directories created in the process of uploading + files and to intermediate-level collected static directories when using + the collectstatic management command.

+

CVE-2020-24584: Permission escalation in intermediate-level directories + of the file system cache on Python 3.7+

+

On Python 3.7+, the intermediate-level directories of the file system + cache had the system's standard umask rather than 0o077 (no group or + others permissions).

+
+ + + + https://docs.djangoproject.com/en/2.2/releases/2.2.16/ + https://docs.djangoproject.com/en/3.0/releases/3.0.10/ + https://docs.djangoproject.com/en/3.1/releases/3.1.1/ + CVE-2020-24583 + CVE-2020-24584 + + + 2020-09-01 + 2020-09-05 + + + gnupg -- AEAD key import overflow