Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-django20) security update

Fixed packages 3

Vulnerabilities 5

• High 7.5
  CVE-2021-31542

  Path Traversal in Django

  In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

  python-django django python-django Debian Ubuntu PyPI
  May 5, 2021
• High 7.5
  CVE-2021-33571

  Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

  In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addr…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jun 8, 2021
• Medium 5.3
  CVE-2021-28658

  Directory Traversal in Django

  In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Apr 6, 2021
• Medium 5.3
  CVE-2021-3281 Public exploit

  Django Directory Traversal via archive.extract

  In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with do…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Feb 2, 2021
• Medium 4.9
  CVE-2021-33203

  Path Traversal in Django

  Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jun 8, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1919969
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1944801
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954294
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966251
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966253
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5070.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3281
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3281
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3281
• report
  https://access.redhat.com/security/cve/CVE-2021-28658
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28658
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28658
• article
  https://www.djangoproject.com/weblog/2021/apr/06/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-31542
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-31542
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-31542
• article
  https://www.djangoproject.com/weblog/2021/may/04/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-33203
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33203
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33203
• article
  https://www.djangoproject.com/weblog/2021/jun/02/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-33571
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33571
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33571