Debian Security Advisory

DLA-3164-1 python-django -- LTS security update

Date Reported:
28 Oct 2022
Affected Packages:
python-django
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2020-24583, CVE-2020-24584, CVE-2021-3281, CVE-2021-23336, CVE-2022-34265.
More information:

Multiple vulnerabilities were discovered in Django, a popular Python-based web development framework:

  • CVE-2020-24583: Fix incorrect permissions on intermediate-level directories on Python 3.7+. FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files and to intermediate-level collected static directories when using the collectstatic management command. You should review and manually fix permissions on existing intermediate-level directories.
  • CVE-2020-24584: Correct permission escalation vulnerability in intermediate-level directories of the file system cache. On Python 3.7 and above, the intermediate-level directories of the file system cache had the system's standard umask rather than 0o077 (no group or others permissions).
  • CVE-2021-3281: Fix a potential directory-traversal exploit via archive.extract(). The django.utils.archive.extract() function, used by startapp --template and startproject --template, allowed directory traversal via an archive with absolute paths or relative paths with dot segments.
  • CVE-2021-23336: Prevent a web cache poisoning attack via "parameter cloaking". Django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued recently such that parse_qsl() no longer allows using ";" as a query parameter separator by default.
  • CVE-2022-34265: The Trunc() and Extract() database functions were subject to a potential SQL injection attack if untrusted data was used as a value for the "kind" or "lookup_name" parameters. Applications that constrain the choice to a known safe list were unaffected.

    For Debian 10 Buster, these problems have been fixed in version 1:1.11.29-1+deb10u2.

    We recommend that you upgrade your python-django packages.

    Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS