Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2020-24584

Published: 1 September 2020

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

Notes

AuthorNote
mdeslaur
This issue is caused by a behavioural change in Python 3.7.
While python3.7 is available for bionic, it doesn't replace
python3.6, so bionic is not affected by this issue.

Priority

Medium

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package Release Status
python-django
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(doesn't use python3.7)
focal
Released (2:2.2.12-1ubuntu0.2)
trusty Not vulnerable
(doesn't use python3.7)
upstream
Released (2.2.16)
xenial Not vulnerable
(doesn't use python3.7)

Severity score breakdown

Parameter Value
Base score 7.5
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N