ASA-202009-4 log original external raw

Arch Linux Security Advisory ASA-202009-4 ========================================= Severity: Medium Date : 2020-09-03 CVE-ID : CVE-2020-24583 CVE-2020-24584 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1217 Summary ======= The package python-django before version 3.1.1-1 is vulnerable to multiple issues including access restriction bypass and insufficient validation. Resolution ========== Upgrade to 3.1.1-1. # pacman -Syu "python-django>=3.1.1-1" The problems have been fixed upstream in version 3.1.1. Workaround ========== None. Description =========== - CVE-2020-24583 (access restriction bypass) An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate- level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command. - CVE-2020-24584 (insufficient validation) An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077. Impact ====== A remote attacker is able to upload and overwrite files. References ========== https://bugs.archlinux.org/task/67794 https://www.djangoproject.com/weblog/2020/sep/01/security-releases/ https://github.com/django/django/commit/934430d22aa5d90c2ba33495ff69a6a1d997d584 https://github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e81915b https://security.archlinux.org/CVE-2020-24583 https://security.archlinux.org/CVE-2020-24584