Vulnerability advisory

PYSEC-2021-9

Published Feb 2, 2021Updated Dec 6, 2023OSV record ↗

Also known as BIT-django-2021-3281CVE-2021-3281GHSA-fvgf-6h6h-3322

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`2.2` to before 2.2.18	`2.2.18`Advisories →
`3.0` to before 3.0.12	`3.0.12`Advisories →
`3.1` to before 3.1.6	`3.1.6`Advisories →
Also listed as affected (36) `2.2` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `2.2.9` `2.2.10` `2.2.11` `2.2.12` `2.2.13` `2.2.14` `2.2.15` `2.2.16` `2.2.17` `3.0` `3.0.1` `3.0.2` `3.0.3` `3.0.4` `3.0.5` `3.0.6` `3.0.7` `3.0.8` `3.0.9` `3.0.10` `3.0.11` `3.1` `3.1.1` `3.1.2` `3.1.3` `3.1.4` `3.1.5`

Description

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

References

Webdocs.djangoproject.com/en/3.1/releases/security/ ↗
ARTICLEwww.djangoproject.com/weblog/2021/feb/01/security-releases/ ↗
Webgroups.google.com/forum/#!forum/django-announce ↗
Weblists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/ ↗
Advisorysecurity.netapp.com/advisory/ntap-20210226-0004/ ↗
Advisorygithub.com/advisories/GHSA-fvgf-6h6h-3322 ↗