CVE-2020-13254: canonical ubuntu_linux Improper Certificate Validation
CVSS: 5.9v3.1MediumModified
AliasesGHSA-wpjr-j57x-wxfwBIT-django-2020-13254PYSEC-2020-31RHSA-2021:0915RHSA-2021:0933UBUNTU-CVE-2020-13254DEBIAN-CVE-2020-13254
Published 03-06-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-13254 is a medium (CVSS 5.9) Improper Certificate Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 6.09% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities.
CVSS score
5.9/10
010
Medium · v3.1 (NVD)EPSS score
6.09%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 14 · Related 12Timeline
- 03-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
CVSS metrics
7 scores · 5 sources · 3 versionsHigh 8.2Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesSingle source
Medium 5.9Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 5 agree
- OSV · PypiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
6.09%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 6.09% on 18-09-2026
18-09-202618-10-2026
EPSS score6.09%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- python-django< 0:1.11.27-3.el7ost
- python-django-bash-completion< 0:1.11.27-3.el7ost
- python-django20< 0:2.0.13-12.el8ost
- python-django20-bash-completion< 0:2.0.13-12.el8ost
- python2-django< 0:1.11.27-3.el7ost
Debian2 products
- python-django< 2:2.2.13-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Netapp2 products
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 19.10 | 20.04
Djangoproject1 product
- django≥ 2.2, < 2.2.13 | ≥ 3.0, < 3.0.7
Fedoraproject1 product
- fedoraEOL32
Oracle1 product
PyPI1 product
- django≥ 2.2, < 2.2.13 | ≥ 3.0, < 3.0.7
Ubuntu1 product
- python-django< 1.6.11-0ubuntu1.3+esm1 | < 1.8.7-1ubuntu5.13 | < 1:1.11.11-1ubuntu1.9 | < 2:2.2.12-1ubuntu0.1
9 vendors · 16 products
References
37 links
lists.debian.org/debian-lts-announce/2020/06/msg00016.htmlMailing ListX Refsource MLISTWEBThird Party Advisory- www.debian.org/security/2020/dsa-4705Vendor AdvisoryX Refsource DEBIANWEBAdvisoryThird Party Advisory
- groups.google.com/d/msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJX Refsource MISCWEBMailing ListRelease NotesThird Party Advisory
- www.djangoproject.com/weblog/2020/jun/03/security-releases/X Refsource CONFIRMARTICLERelease NotesVendor Advisory
Show all 37 references
- github.com/django/djangoPACKAGE