CVE-2020-13254 Data leakage via cache key collision in Django
Attackers can cause cache key collisions in Django when using memcached without key validation, leading to potential data leakage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13254?
CVE-2020-13254 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 3 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
Weakness: CWE-295
Which versions are affected by CVE-2020-13254?
6 open source packages ship an affected version, including django and Django. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
django Bitnami | From 2.2.0 | 2.2.13, 3.0.7 |
django PyPI | From 2.2 | 2.2.13, 3.0.7 |
django PyPI | From 2.2 | 2.2.13 |
django PyPI | From 3.0 | 3.0.7 |
Django PyPI | From 2.2 | 2.2.13 |
Django PyPI | From 3.0 | 3.0.7 |
Linux distribution packages (6)
python-django Red Hat:openstack:13::el7 | All versions | 0:1.11.27-3.el7ost |
python-django-bash-completion Red Hat:openstack:13::el7 | All versions | 0:1.11.27-3.el7ost |
python2-django Red Hat:openstack:13::el7 | All versions | 0:1.11.27-3.el7ost |
python-django20 Red Hat:openstack:16.1::el8 | All versions | 0:2.0.13-12.el8ost |
python-django20-bash-completion Red Hat:openstack:16.1::el8 | All versions | 0:2.0.13-12.el8ost |
python3-django20 Red Hat:openstack:16.1::el8 | All versions | 0:2.0.13-12.el8ost |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Djangoproject Django, Fedoraproject Fedora, Netapp Sra Plugin, Netapp Steelstore Cloud Integrated Storage and 1 more.
How do I fix CVE-2020-13254?
Upgrade django to a fixed version for your release line: 2.2.13 or 3.0.7.
Is CVE-2020-13254 being exploited?
There is no known exploitation of CVE-2020-13254 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as BIT-django-2020-13254, DEBIAN-CVE-2020-13254, GHSA-wpjr-j57x-wxfw, PYSEC-2020-31, RHSA-2021:0915, RHSA-2021:0933 and 1 more.