Django-2.0.13-py3-none-any.whl: 5 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - Django-2.0.13-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/67/b0/64645bd6c5cdabb07d361e568eecfa9e64027ae4cb4778bb00be8c4bde00/Django-2.0.13-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /Pipfile

Found in HEAD commit: 925a67cbfda81510fc4912fd90b71ddded6b96c1

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Django version)	Remediation Possible**
CVE-2022-34265	Critical	9.8	Django-2.0.13-py3-none-any.whl	Direct	Django - 3.2.14,4.0.6	✅
CVE-2019-19844	Critical	9.8	Django-2.0.13-py3-none-any.whl	Direct	1.11.27;2.2.9;3.0.1	✅
CVE-2019-14234	Critical	9.8	Django-2.0.13-py3-none-any.whl	Direct	2.2.4, 2.1.11, 1.11.23	✅
CVE-2020-9402	High	8.8	Django-2.0.13-py3-none-any.whl	Direct	1.11.29,2.2.11,3.0.4	✅
CVE-2021-44420	High	7.3	Django-2.0.13-py3-none-any.whl	Direct	Django - 2.2.25,3.1.14,3.2.10	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-34265

Vulnerable Library - Django-2.0.13-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/67/b0/64645bd6c5cdabb07d361e568eecfa9e64027ae4cb4778bb00be8c4bde00/Django-2.0.13-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /Pipfile

Dependency Hierarchy:

• ❌ Django-2.0.13-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 925a67cbfda81510fc4912fd90b71ddded6b96c1

Found in base branch: main

Vulnerability Details

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
Mend Note: After conducting further research, Mend has determined that all versions of Django before version 3.2.14 and before 4.0.6 are vulnerable to CVE-2022-34265.

Publish Date: 2022-07-04

URL: CVE-2022-34265

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.djangoproject.com/weblog/2022/jul/04/security-releases/

Release Date: 2022-07-04

Fix Resolution: Django - 3.2.14,4.0.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-19844

Vulnerable Library - Django-2.0.13-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/67/b0/64645bd6c5cdabb07d361e568eecfa9e64027ae4cb4778bb00be8c4bde00/Django-2.0.13-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /Pipfile

Dependency Hierarchy:

• ❌ Django-2.0.13-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 925a67cbfda81510fc4912fd90b71ddded6b96c1

Found in base branch: main

Vulnerability Details

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Publish Date: 2019-12-18

URL: CVE-2019-19844

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19844

Release Date: 2019-12-18

Fix Resolution: 1.11.27;2.2.9;3.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-14234

Vulnerable Library - Django-2.0.13-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/67/b0/64645bd6c5cdabb07d361e568eecfa9e64027ae4cb4778bb00be8c4bde00/Django-2.0.13-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /Pipfile

Dependency Hierarchy:

• ❌ Django-2.0.13-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 925a67cbfda81510fc4912fd90b71ddded6b96c1

Found in base branch: main

Vulnerability Details

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

Publish Date: 2019-08-09

URL: CVE-2019-14234

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.djangoproject.com/weblog/2019/aug/01/security-releases/

Release Date: 2019-08-09

Fix Resolution: 2.2.4, 2.1.11, 1.11.23

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-9402

Vulnerable Library - Django-2.0.13-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/67/b0/64645bd6c5cdabb07d361e568eecfa9e64027ae4cb4778bb00be8c4bde00/Django-2.0.13-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /Pipfile

Dependency Hierarchy:

• ❌ Django-2.0.13-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 925a67cbfda81510fc4912fd90b71ddded6b96c1

Found in base branch: main

Vulnerability Details

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

Publish Date: 2020-03-05

URL: CVE-2020-9402

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9402

Release Date: 2020-03-05

Fix Resolution: 1.11.29,2.2.11,3.0.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-44420

Vulnerable Library - Django-2.0.13-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/67/b0/64645bd6c5cdabb07d361e568eecfa9e64027ae4cb4778bb00be8c4bde00/Django-2.0.13-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /Pipfile

Dependency Hierarchy:

• ❌ Django-2.0.13-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 925a67cbfda81510fc4912fd90b71ddded6b96c1

Found in base branch: main

Vulnerability Details

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

Publish Date: 2021-12-07

URL: CVE-2021-44420

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://docs.djangoproject.com/en/3.2/releases/security/

Release Date: 2021-12-07

Fix Resolution: Django - 2.2.25,3.1.14,3.2.10

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.