Arch Linux Security Advisory ASA-202009-4
=========================================

Severity: Medium
Date    : 2020-09-03
CVE-ID  : CVE-2020-24583 CVE-2020-24584
Package : python-django
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1217

Summary
=======

The package python-django before version 3.1.1-1 is vulnerable to
multiple issues including access restriction bypass and insufficient
validation.

Resolution
==========

Upgrade to 3.1.1-1.

# pacman -Syu "python-django>=3.1.1-1"

The problems have been fixed upstream in version 3.1.1.

Workaround
==========

None.

Description
===========

- CVE-2020-24583 (access restriction bypass)

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10,
and 3.1 before 3.1.1 (when Python 3.7+ is used).
FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-
level directories created in the process of uploading files. It was
also not applied to intermediate-level collected static directories
when using the collectstatic management command.

- CVE-2020-24584 (insufficient validation)

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10,
and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level
directories of the filesystem cache had the system's standard umask
rather than 0o077.

Impact
======

A remote attacker is able to upload and overwrite files.

References
==========

https://bugs.archlinux.org/task/67794
https://www.djangoproject.com/weblog/2020/sep/01/security-releases/
https://github.com/django/django/commit/934430d22aa5d90c2ba33495ff69a6a1d997d584
https://github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e81915b
https://security.archlinux.org/CVE-2020-24583
https://security.archlinux.org/CVE-2020-24584