CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected f...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
django
[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"3.2.15"},{"introduced":"4.0.0"},{"fixed":"4.0.7"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-36359 python-django Corrigé dans: 2:2.2.28-1~deb11u1
Références
- advisory openwall.com
- advisory docs.djangoproject.com
- advisory groups.google.com
- advisory security.netapp.com
- advisory debian.org
- advisory djangoproject.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov