python-django: CVE-2020-13254 CVE-2020-13596

Debian Bug report logs - #962323
python-django: CVE-2020-13254 CVE-2020-13596

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: submit@bugs.debian.org

Subject: python-django: CVE-2020-13254 CVE-2020-13596

Date: Sat, 06 Jun 2020 10:09:31 +0100

Package: python-django
Version: 1.7.11-1+deb8u3
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for python-django.

CVE-2020-13254[0]:
| An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before
| 3.0.7. In cases where a memcached backend does not perform key
| validation, passing malformed cache keys could result in a key
| collision, and potential data leakage.


CVE-2020-13596[1]:
| An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before
| 3.0.7. Query parameters generated by the Django admin
| ForeignKeyRawIdWidget were not properly URL encoded, leading to a
| possibility of an XSS attack.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-13254
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13254
[1] https://security-tracker.debian.org/tracker/CVE-2020-13596
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13596


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #16 received at 962323@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: 962323@bugs.debian.org, team@security.debian.org

Subject: Re: python-django: CVE-2020-13254 CVE-2020-13596

Date: Sat, 06 Jun 2020 10:15:16 +0100

Hi,

> python-django: CVE-2020-13254 CVE-2020-13596

Security team, would you like an update for stretch and/or buster to
address these issues? It's fixed in sid, experimental as well as
jessie LTS. Bullseye is just pending migration time AFAICT.


Regards,

--
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Send a report that this bug log contains spam.