Spoofing attack in Django - CVE-2022-36359

Vulnerability identifier: #VU66019

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36359

CWE-ID: CWE-451

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in the FileResponse method. A remote attacker can spoof content of downloaded file and perform reflected file download (RFD) attack.

Django
Debian Linux
Gentoo Linux
Oracle Solaris
Ubuntu
Fedora
python3-django (Ubuntu package)
python-django (Debian package)
python-django
dev-python/django

Install updates from vendor's website.

Django - addressed in versions 3.2.15, 4.0.7
python3-django (Ubuntu package) - addressed in versions 2:2.2.12-1ubuntu0.13, 2:3.2.12-2ubuntu1.2
python-django (Debian package) - update to 2:2.2.28-1~deb11u1
python-django - addressed in versions 4.0.10-1.fc37, 4.0.10-1.fc38
dev-python/django - update to 5.2.1

• https://www.djangoproject.com/weblog/2022/aug/03/security-releases/

• Spoofing attack in Django
• Ubuntu update for python-django
• Debian update for python-django
• Oracle Solaris update for third-party software
• Fedora 38 update for python-django
• Fedora 37 update for python-django
• Gentoo update for Django