CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected f...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
django
[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"3.2.15"},{"introduced":"4.0.0"},{"fixed":"4.0.7"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-36359 python-django 修正版: 2:2.2.28-1~deb11u1
参照URL
- advisory openwall.com
- advisory docs.djangoproject.com
- advisory groups.google.com
- advisory security.netapp.com
- advisory debian.org
- advisory djangoproject.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov