En bref
- CVE-2020-24584 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant django, django (djangoproject), zfs storage appliance kit (oracle).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 3.3%, plus élevée que 88.5% des vulnérabilités.
- Correctif : mettre à jour vers 2.2.16, 3.0.10, 3.1.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| django PyPI | ≥ 2.2, < 2.2.16≥ 3.0, < 3.0.10≥ 3.1, < 3.1.1
| 2.2.163.0.103.1.1
|
| django | ≥ 2.2, < 2.2.16≥ 3.0, < 3.0.10≥ 3.1, < 3.1.1
| 2.2.163.0.103.1.1
|
| zfs storage appliance kit | = 8.8
| No fix yet |
Description
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.
NVD description
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free