Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2020-13254 |
CWE-ID | CWE-295 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #1 is available. |
Vulnerable software Subscribe |
py3-django (Alpine package) Operating systems & Components / Operating system package or component |
Vendor | Alpine Linux Development Team |
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU28954
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-13254
CWE-ID:
CWE-295 - Improper Certificate Validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information on the system
The vulnerability exists when a memcached backend does not perform key validation. A remote attacker can gain access to sensitive information on the target system.
MitigationInstall update from vendor's website.
Vulnerable software versionspy3-django (Alpine package): 1.11.29-r0 - 3.1.4-r0
py3-django (Alpine package):
http://git.alpinelinux.org/aports/commit/?id=99208f01e803e97143b9109999a5fbef2cb1c742
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?