SNYK-PYTHON-DJANGO-1076802
## Overview [Django](https://pypi.org/project/Django/) is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Web Cache Poisoning. Django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued recently such that parse_qsl() no longer allows using ; as a query parameter separator by default. ## Remediation Upgrade `Django` to version 2.2.19, 3.0.13, 3.1.7 or higher. ## References - [Django Security Releases](https://www.djangoproject.com/weblog/2021/feb/19/security-releases/) - [GitHub Commit](https://github.com/django/django/commit/be8237c7cce24b06aabde0b97afce98ddabbe3b6) - [Snyk Cache Poisoning Blogpost](https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/)
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 2.2, 0, 0 |
Timeline
- Feb 19, 2021 CVE Updated
- Feb 19, 2021 CVE Published
References
- https://security.snyk.io/vuln/SNYK-PYTHON-DJANGO-1076802 advisory
- https://pypi.org/project/Django/ vendor
- https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ technical
- https://github.com/django/django/commit/be8237c7cce24b06aabde0b97afce98ddabbe3b6 patch
- https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ technical