FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-29 07:54:42 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
1685144e-63ff-11ea-a93a-080027846a02Django -- potential SQL injection vulnerability

MITRE CVE reports:

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.


Discovery 2020-02-25
Entry 2020-03-12
py27-django111
py35-django111
py36-django111
py37-django111
py38-django111
< 1.11.29

py35-django22
py36-django22
py37-django22
py38-django22
< 2.2.11

py36-django30
py37-django30
py38-django30
< 3.0.4

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9402
https://www.djangoproject.com/weblog/2020/mar/04/security-releases/
CVE-2020-9402
002432c8-ef6a-11ea-ba8f-08002728f74cDjango -- multiple vulnerabilities

Django Release notes:

CVE-2020-24583: Incorrect permissions on intermediate-level directories on Python 3.7+

On Python 3.7+, FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files and to intermediate-level collected static directories when using the collectstatic management command.

CVE-2020-24584: Permission escalation in intermediate-level directories of the file system cache on Python 3.7+

On Python 3.7+, the intermediate-level directories of the file system cache had the system's standard umask rather than 0o077 (no group or others permissions).


Discovery 2020-09-01
Entry 2020-09-05
py35-django22
py36-django22
py37-django22
py38-django22
< 2.2.16

py36-django30
py37-django30
py38-django30
< 3.0.10

py36-django31
py37-django31
py38-django31
< 3.1.1

https://docs.djangoproject.com/en/2.2/releases/2.2.16/
https://docs.djangoproject.com/en/3.0/releases/3.0.10/
https://docs.djangoproject.com/en/3.1/releases/3.1.1/
CVE-2020-24583
CVE-2020-24584
597d02ce-a66c-11ea-af32-080027846a02Django -- multiple vulnerabilities

Django security release reports:

CVE-2020-13254: Potential data leakage via malformed memcached keys

In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. In order to avoid this vulnerability, key validation is added to the memcached cache backends.

CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget

Query parameters for the admin ForeignKeyRawIdWidget were not properly URL encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query parameters are correctly URL encoded.


Discovery 2020-06-01
Entry 2020-06-04
py36-django22
py37-django22
py38-django22
< 2.2.13

py36-django30
py37-django30
py38-django30
< 3.0.7

https://www.djangoproject.com/weblog/2020/jun/03/security-releases/
CVE-2020-13254
CVE-2020-13596