Vulnerability advisory

PYSEC-2022-245

Published Aug 3, 2022Updated Jan 14, 2025OSV record ↗

Also known as BIT-django-2022-36359CVE-2022-36359GHSA-8x94-hmjh-97hq

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`3.2` to before 3.2.15	`3.2.15`Advisories →
`4.0` to before 4.0.7	`4.0.7`Advisories →
Also listed as affected (22) `3.2` `3.2.1` `3.2.10` `3.2.11` `3.2.12` `3.2.13` `3.2.14` `3.2.2` `3.2.3` `3.2.4` `3.2.5` `3.2.6` `3.2.7` `3.2.8` `3.2.9` `4.0` `4.0.1` `4.0.2` `4.0.3` `4.0.4` `4.0.5` `4.0.6`

Description

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

References

Webdocs.djangoproject.com/en/4.0/releases/security/ ↗
ARTICLEwww.djangoproject.com/weblog/2022/aug/03/security-releases/ ↗
Webgroups.google.com/g/django-announce/c/8cz--gvaJr4 ↗
Webwww.openwall.com/lists/oss-security/2022/08/03/1 ↗
Advisorygithub.com/advisories/GHSA-8x94-hmjh-97hq ↗