CVE-2020-13254: Medium severity djangoproject Django vulnerability
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
Other sources
An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.0.7 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.2.13 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.28-1~deb11u2Fixed in 3:3.2.19-1+deb12u1Fixed in 3:4.2.16-1 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.0.7-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 2.2.13 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 3.0.7
Event History
Frequently Asked Questions
What is CVE-2020-13254?
CVE-2020-13254 is a vulnerability in Django versions 2.2 before 2.2.13 and 3.0 before 3.0.7 that can result in key collision and potential data leakage.
How severe is CVE-2020-13254?
CVE-2020-13254 has a severity rating of 5.9, which is considered medium.
How can I fix CVE-2020-13254?
To fix CVE-2020-13254, you should update Django to version 2.2.13 or 3.0.7, depending on the version you are using.
Where can I find more information about CVE-2020-13254?
You can find more information about CVE-2020-13254 on the NIST National Vulnerability Database (NVD) and Django's official security releases page.
What is the CWE of CVE-2020-13254?
The CWE (Common Weakness Enumeration) of CVE-2020-13254 is CWE-295, which is the category for Improper Certificate Validation.