Django Filesystem Cache Vulnerability in py-django and py3-django Packages
Summary
ALPINE-CVE-2020-24584: An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). Affects py-django versions < 1.11.29-r1. Fixed in 1.11.29-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, and templating. The affected packages, py-django and py3-django, are versions of Django tailored for Alpine Linux, a security-oriented, lightweight Linux distribution. This vulnerability affects the filesystem cache mechanism of Django, which can lead to improper permission settings on cache directories.
Vulnerability Detail
An issue was discovered in Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when using Python 3.7 or higher. The vulnerability arises from the intermediate-level directories of the filesystem cache being created with the system's standard umask instead of the more restrictive 0o077. This can lead to unauthorized access to cached files, potentially exposing sensitive information to unauthorized users.
How To Fix
Minimum fixed version
1.11.29-r1
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually set the umask for your application to 0o077 before starting the Django server. This can be done by adding the following line to your startup script: 'umask 0077'. However, this is not a permanent solution and updating the package is recommended.
Conclusion
The vulnerability in the Django filesystem cache mechanism poses significant risks to applications using the affected py-django and py3-django packages. It is crucial to update to the patched version to mitigate these risks and protect sensitive data.
See every vulnerability recorded for py-django →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential risks include unauthorized access to sensitive cached data, which could lead to data breaches or exposure of confidential information.
Yes, the permanent fix is to update the affected packages to version 1.11.29-r1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
