pysec-2021-7
Vulnerability from pysec
Published
2021-05-05 15:15
Modified
2021-05-13 13:41
Details
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django",
"purl": "pkg:pypi/django"
},
"ranges": [
{
"events": [
{
"introduced": "2.2"
},
{
"fixed": "2.2.21"
},
{
"introduced": "3.1"
},
{
"fixed": "3.1.9"
},
{
"introduced": "3.2"
},
{
"fixed": "3.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.2",
"2.2.1",
"2.2.2",
"2.2.3",
"2.2.4",
"2.2.5",
"2.2.6",
"2.2.7",
"2.2.8",
"2.2.9",
"2.2.10",
"2.2.11",
"2.2.12",
"2.2.13",
"2.2.14",
"2.2.15",
"2.2.16",
"2.2.17",
"2.2.18",
"2.2.19",
"2.2.20",
"3.1",
"3.1.1",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.7",
"3.1.8",
"3.2"
]
}
],
"aliases": [
"CVE-2021-31542",
"GHSA-rxjp-mfm9-w4wr"
],
"details": "In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.",
"id": "PYSEC-2021-7",
"modified": "2021-05-13T13:41:00Z",
"published": "2021-05-05T15:15:00Z",
"references": [
{
"type": "ARTICLE",
"url": "https://www.djangoproject.com/weblog/2021/may/04/security-releases/"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/3.2/releases/security/"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/3"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!forum/django-announce"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00005.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-rxjp-mfm9-w4wr"
}
]
}
Loading...