CVE-2020-24583
Fixed in a distro release EPSS 4%
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.
Products: djangoproject django, canonical ubuntu_linux, fedoraproject fedora, oracle zfs_storage_appliance_kit
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 2.2.16 |
| PyPI | django | 3.0.10 |
| PyPI | django | 3.1.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | py-django | 1.11.29-r1 |
| Alpine 3.11 | py3-django | 1.11.29-r1 |
| Alpine 3.12 | py3-django | 1.11.29-r1 |
| Alpine 3.9 | py-django | 1.11.29-r1 |
| Arch Linux | python-django | 3.1.1-1 |
| Debian 10 | python-django | 1:1.11.29-1+deb10u2 |
| Debian 12 | python-django | 2:2.2.16-1 |
| Debian 13 | python-django | 2:2.2.16-1 |
| Debian 14 | python-django | 2:2.2.16-1 |
| Ubuntu 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.2 |
| openSUSE Tumbleweed | python-Django | 3.2.7-2.3 |
| openSUSE Tumbleweed | python-Django | 4.2.11-2.1 |
| openSUSE Tumbleweed | python-Django | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.30-4.1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 |