python-django - security update

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2021-31542

  Path Traversal in Django

  In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

  python-django django python-django Debian Ubuntu PyPI
  May 5, 2021
• High 7.5
  CVE-2021-33571

  Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

  In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addr…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jun 8, 2021
• Medium 5.3
  CVE-2021-28658

  Directory Traversal in Django

  In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Apr 6, 2021
• Medium 4.9
  CVE-2021-33203

  Path Traversal in Django

  Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jun 8, 2021