CVE-2024-39330

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

Read the notes from the security team

Why is this CVE low priority?

Does not affect any of the built-in classes

Learn more about Ubuntu priority

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python-django	24.10 oracular	Not affected
	24.04 LTS noble	Fixed 3:4.2.11-1ubuntu1.1
	23.10 mantic	Fixed 3:4.2.4-1ubuntu2.3
	22.04 LTS jammy	Fixed 2:3.2.12-2ubuntu1.12
	20.04 LTS focal	Fixed 2:2.2.12-1ubuntu0.23
	18.04 LTS bionic	Fixed 1:1.11.11-1ubuntu1.21+esm5 Ubuntu Pro
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

alexmurray

upstream advises that only versions 4.2, 5.0 and 5.1 (plus main development branch) are affected but it is likely earlier versions may also be affected but upstream do not mention this as they are no longer maintained by them

References

Related Ubuntu Security Notices (USN)

USN-6888-1
Django vulnerabilities
9 July 2024

USN-6888-2
Django vulnerabilities
11 July 2024

Other references

https://www.cve.org/CVERecord?id=CVE-2024-39330