Django -- multiple vulnerabilities

2020-06-0100:00:00

vuxml.freebsd.org

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.023 Low

EPSS

Percentile

89.5%

JSON

Django security release reports:

CVE-2020-13254: Potential data leakage via malformed memcached keys
In cases where a memcached backend does not perform key validation, passing
malformed cache keys could result in a key collision, and potential data leakage.
In order to avoid this vulnerability, key validation is added to the memcached
cache backends.
CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget
Query parameters for the admin ForeignKeyRawIdWidget were not properly URL
encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query
parameters are correctly URL encoded.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchpy36-django22< 2.2.13UNKNOWN
FreeBSDanynoarchpy37-django22< 2.2.13UNKNOWN
FreeBSDanynoarchpy38-django22< 2.2.13UNKNOWN
FreeBSDanynoarchpy36-django30< 3.0.7UNKNOWN
FreeBSDanynoarchpy37-django30< 3.0.7UNKNOWN
FreeBSDanynoarchpy38-django30< 3.0.7UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	py36-django22	< 2.2.13	UNKNOWN
FreeBSD	any	noarch	py37-django22	< 2.2.13	UNKNOWN
FreeBSD	any	noarch	py38-django22	< 2.2.13	UNKNOWN
FreeBSD	any	noarch	py36-django30	< 3.0.7	UNKNOWN
FreeBSD	any	noarch	py37-django30	< 3.0.7	UNKNOWN
FreeBSD	any	noarch	py38-django30	< 3.0.7	UNKNOWN