739952 – (CVE-2020-24583, CVE-2020-24584) <dev-python/django-{2.2.16, 3.0.10}: Multiple vulnerabilities (CVE-2020-{24583,24584})

Bug 739952 (CVE-2020-24583, CVE-2020-24584) - <dev-python/django-{2.2.16, 3.0.10}: Multiple vulnerabilities (CVE-2020-{24583,24584})

Summary: <dev-python/django-{2.2.16, 3.0.10}: Multiple vulnerabilities (CVE-2020-{2458...

Status:	RESOLVED FIXED

Alias:	CVE-2020-24583, CVE-2020-24584

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://www.djangoproject.com/weblog/...
Whiteboard:	B4 [noglsa]
Keywords:

Depends on:	740208
Blocks:
	Show dependency tree

Reported:	2020-09-02 03:20 UTC by Sam James
Modified:	2021-01-25 23:54 UTC (History)
CC List:	2 users (show)

See Also:
Package list:	dev-python/django-2.2.16-r1 dev-python/django-3.0.10-r1
Runtime testing required:	---

Flags:	nattka: sanity-check-

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2020-09-02 03:20:13 UTC

* CVE-2020-24583

Description:
"An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command."

* CVE-2020-24584

Description:
"An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077."

Comment 1 Sam James archtester

2020-09-02 03:20:45 UTC

Please bump to 2.2.16, 3.0.10, 3.1.1.

Comment 2 Michał Górny archtester

2020-09-02 06:09:31 UTC

Already started doing that, Sir, before I read the mail!

Comment 3 Sam James archtester

2020-09-02 17:25:42 UTC

(In reply to Michał Górny from comment #2)
> Already started doing that, Sir, before I read the mail!

Whatever you say ;). Thank you!

Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev

2020-09-03 18:44:32 UTC

x86 stable

Comment 5 Thomas Deutschmann (RETIRED) gentoo-dev

2020-09-03 18:44:57 UTC

amd64 stable

Comment 6 NATTkA bot gentoo-dev

2020-09-03 18:48:49 UTC

Resetting sanity check; keywords are not fully specified and arches are not CC-ed.

Comment 7 Larry the Git Cow gentoo-dev

2020-09-03 19:58:09 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=468ced3f2059b2c230993b58dc1b221e0b74355d

commit 468ced3f2059b2c230993b58dc1b221e0b74355d
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2020-09-03 19:57:37 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2020-09-03 19:57:37 +0000

    dev-python/django: Remove old
    
    Bug: https://bugs.gentoo.org/739952
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 dev-python/django/Manifest             |  5 ---
 dev-python/django/django-2.2.13.ebuild | 78 ---------------------------------
 dev-python/django/django-2.2.15.ebuild | 78 ---------------------------------
 dev-python/django/django-3.0.8.ebuild  | 79 ----------------------------------
 dev-python/django/django-3.0.9.ebuild  | 79 ----------------------------------
 dev-python/django/django-3.1.ebuild    | 79 ----------------------------------
 6 files changed, 398 deletions(-)

Comment 8 NATTkA bot gentoo-dev

2020-10-22 07:40:53 UTC

Unable to check for sanity:

> no match for package: dev-python/django-3.0.10

Comment 9 NATTkA bot gentoo-dev

2020-10-22 07:52:57 UTC

Unable to check for sanity:

> no match for package: dev-python/django-2.2.16-r1