logo

Database

Missing subresource integrity check In django

Description

Django vulnerable to Reflected File Download attack An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-363592. NVD-2022-363593. OSV-2022-363594. OSV-DEBIAN-2022-363595. GCVE-2022-363596. SECURITY-TRACKER-CVE-2022-36359

References

1. https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b802. https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb33. https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa1734. https://docs.djangoproject.com/en/4.0/releases/security5. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml6. https://groups.google.com/g/django-announce/c/8cz--gvaJr47. https://lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK8. https://lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI9. https://security.netapp.com/advisory/ntap-20220915-000810. https://www.debian.org/security/2022/dsa-525411. https://www.djangoproject.com/weblog/2022/aug/03/security-releases12. http://www.openwall.com/lists/oss-security/2022/08/03/1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.