CVE-2020-13254

Description

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

How to fix CVE-2020-13254

To remediate CVE-2020-13254, upgrade the affected package to a fixed version below.

• Bitnami/django—upgrade to 2.2.13 or later
• —upgrade to 2:2.2.13-1 or later
• —upgrade to 1.7.11-1+deb8u9 or later
• —upgrade to 1:1.10.7-2+deb9u9 or later
• —upgrade to 2.2.13 or later
• —upgrade to 2.2.13 or later

Is CVE-2020-13254 being exploited?

Moderate — EPSS is 6.1%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (6)

• >= 2.2.0, < 2.2.13, >= 3.0.0, < 3.0.7
• from 0, < 2:2.2.13-1
• from 0, < 1.7.11-1+deb8u9
• from 0, < 1:1.10.7-2+deb9u9
• >= 2.2, < 2.2.13
• >= 2.2, < 2.2.13, >= 3.0, < 3.0.7

CVSS scores

References (24)

• ADVISORYgithub.com/advisories/GHSA-wpjr-j57x-wxfw
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-13254
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-13254
• ADVISORYsecurity.netapp.com/advisory/ntap-20200611-0002/
• ADVISORY