Data leakage via cache key collision in Django
Moderate severity
GitHub Reviewed
Published
Jun 5, 2020
to the GitHub Advisory Database
•
Updated Sep 5, 2023
Package
Affected versions
>= 2.0.0, < 2.2.13
>= 3.0.0, < 3.0.7
Patched versions
2.2.13
3.0.7
Description
Published by the National Vulnerability Database
Jun 3, 2020
Reviewed
Jun 4, 2020
Published to the GitHub Advisory Database
Jun 5, 2020
Last updated
Sep 5, 2023
Credits
-
tdunlap607 Analyst
An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
References