GitHub Advisoryadvisory · PyPI
GHSA-rxjp-mfm9-w4wr Path Traversal in Django
HIGH
Official page ↗
- Aliases
- CVE-2021-31542
- Ecosystem
- PyPI
- Packages
- Django
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22, CWE-434
- Reviewed
- 2021-05-19
Affected packages
• PyPI Django: >= 2.2, < 2.2.21 → fixed in 2.2.21
• PyPI Django: >= 3.0, < 3.1.9 → fixed in 3.1.9
• PyPI Django: >= 3.2, < 3.2.1 → fixed in 3.2.1
Description
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
Related
Alias · CVE (1)
- CVE-2021-31542 In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-31542 advisory
- https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d web
- https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48 web
- https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007 web
- https://www.djangoproject.com/weblog/2021/may/04/security-releases web
- https://security.netapp.com/advisory/ntap-20210618-0001 web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV web
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE web
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV web
- https://lists.debian.org/debian-lts-announce/2021/05/msg00005.html web
- https://groups.google.com/forum/#%21forum/django-announce web
- https://groups.google.com/forum/#!forum/django-announce web
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-7.yaml web
- https://github.com/django/django package
- https://github.com/advisories/GHSA-rxjp-mfm9-w4wr advisory
- https://docs.djangoproject.com/en/3.2/releases/security web
- http://www.openwall.com/lists/oss-security/2021/05/04/3 web