Описание
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
A flaw was found in Django, where the memcached backend does not perform key validation and passes malformed keys. This flaw causes a key collision and potential data leakage. The highest threat from this vulnerability is to confidentiality.
Отчет
Red Hat Satellite 6 ships affected python-django, however, it does not use memcached implementation in product code hence not vulnerable to this flaw. Red Hat Update Infrastructure 3 ships an affected version of python-django, however it does not use memcached as a cache backend and it is not vulnerable to this flaw. Red Hat Ceph Storage(RHCS) ships an affected version of python-django used with calamari and graphite which are no longer supported, hence the django package will not be fixed for RHCS.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 2 | python-django | Will not fix | ||
| Red Hat Ceph Storage 3 | python-django | Will not fix | ||
| Red Hat OpenStack Platform 10 (Newton) | python-django | Out of support scope | ||
| Red Hat OpenStack Platform 15 (Stein) | python-django | Out of support scope | ||
| Red Hat OpenStack Platform 15 (Stein) | python-django20 | Out of support scope | ||
| Red Hat Satellite 6 | python-django | Will not fix | ||
| Red Hat Storage 3 | python-django | Affected | ||
| Red Hat Update Infrastructure 3 for Cloud Providers | python-django | Fix deferred | ||
| Red Hat OpenStack Platform 13.0 (Queens) | python-django | Fixed | RHSA-2021:0933 | 18.03.2021 |
| Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS | python-django | Fixed | RHSA-2021:0933 | 18.03.2021 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0 ...
Уязвимость библиотеки Django, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
5.9 Medium
CVSS3