Description
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 2:2.2.21-1 | — |
| Debian 13 | python-django | 2:2.2.21-1 | — |
| Debian 12 | python-django | 2:2.2.21-1 | — |
| Debian 10 | python-django | 1:1.11.29-1+deb10u11 | DLA-3744-1 |
| Debian 9 | python-django | 1:1.10.7-2+deb9u13 | DLA-2651-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.6 | USN-4932-1 |
| Ubuntu 18.04 LTS | python-django | 1:1.11.11-1ubuntu1.13 | USN-4932-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | python-django | 1.8.7-1ubuntu5.15+esm1 | USN-4932-2 |
| Ubuntu Pro 14.04 LTS | python-django | 1.6.11-0ubuntu1.3+esm3 | USN-4932-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | satellite +1 | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | candlepin | 4.0.9-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | satellite | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-activerecord-session_store | 2.0.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-addressable | 2.8.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.3.2-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-rails +1 | 6.0.3.7-1.el7sat | RHSA-2021:4702 |
| Red Hat OpenStack 16 | python-django20 +2 | 2.0.13-16.el8ost.1 | RHSA-2021:5070 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | cassandra | 3.11.10-3.3.3 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | crowbar-openstack | 6.0+git.1616146717.a89ae0f4e-3.34.4 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | grafana | 6.7.4-3.23.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | kibana | 4.6.6-4.9.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-dashboard | 14.1.1~dev11-3.24.6 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-ironic | 11.1.5~dev17-3.25.5 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.8~dev164-3.37.4 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 12.0.1~dev29-3.25.3 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-nova | 18.3.1~dev82-3.37.6 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Django1 | 1.11.29-3.25.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-elementpath | 1.3.1-1.3.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-py | 1.5.4-3.3.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-pysaml2 | 4.5.0-4.6.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-xmlschema | 1.0.18-1.3.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-activerecord-session_store | 0.1.2-4.3.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud Crowbar 8 | cassandra | 3.11.10-5.3.5 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-core | 5.0+git.1622489449.a8e60e238-3.50.4 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-openstack | 5.0+git.1616001417.67fd9c2a1-4.52.5 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | documentation-suse-openstack-cloud-deployment +3 | 8.20210512-1.32.5 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | grafana | 6.7.4-4.18.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | kibana | 4.6.6-3.9.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-templates | 0.0.0+git.1623056900.7917e18-3.21.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-installer | 20190923_16.32-3.18.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova +1 | 16.1.9~dev92-3.48.5 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Django | 1.11.29-3.25.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-elementpath | 1.3.1-1.3.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-eventlet | 0.20.0-6.3.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-py | 1.4.34-3.3.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-pysaml2 | 4.0.2-5.9.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-xmlschema | 1.0.18-1.3.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-activerecord-session_store | 0.1.2-3.3.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 9 | ardana-neutron | 9.0+git.1615223676.777f0b3-3.25.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | ardana-swift | 9.0+git.1618235096.90974ed-3.10.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | cassandra | 3.11.10-3.3.3 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | grafana | 6.7.4-3.23.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | kibana | 4.6.6-4.9.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | openstack-dashboard | 14.1.1~dev11-3.24.6 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | openstack-ironic | 11.1.5~dev17-3.25.5 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.8~dev164-3.37.4 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 12.0.1~dev29-3.25.3 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | openstack-nova | 18.3.1~dev82-3.37.6 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | python-Django1 | 1.11.29-3.25.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | python-elementpath | 1.3.1-1.3.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | python-py | 1.5.4-3.3.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | python-pysaml2 | 4.5.0-4.6.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | python-xmlschema | 1.0.18-1.3.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.23.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.10~dev20-3.26.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.23.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-glance | 17.0.1~dev30-3.21.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.23.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.27.3 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-ironic | 11.1.5~dev17-4.21.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev4-3.24.3 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.23.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.4.2~dev60-3.29.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.21.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.23.2 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev164-6.27.3 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev82-3.27.3 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.23.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.23.1 | SUSE-SU-2021:1962-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.2~dev48-2.18.1 | SUSE-SU-2021:1962-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 8 | ardana-cobbler | 8.0+git.1614096566.e8c2b27-3.44.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | cassandra | 3.11.10-5.3.5 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | documentation-suse-openstack-cloud-user +8 | 8.20210512-1.32.5 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | grafana | 6.7.4-4.18.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | kibana | 4.6.6-3.9.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | openstack-heat-templates | 0.0.0+git.1623056900.7917e18-3.21.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-installer | 20190923_16.32-3.18.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | openstack-nova +1 | 16.1.9~dev92-3.48.5 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | python-Django | 1.11.29-3.25.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | python-elementpath | 1.3.1-1.3.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | python-eventlet | 0.20.0-6.3.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | python-py | 1.4.34-3.3.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | python-pysaml2 | 4.0.2-5.9.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | python-xmlschema | 1.0.18-1.3.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-aodh | 5.1.1~dev7-12.32.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.2~dev3-12.33.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.30.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-cinder | 11.2.3~dev29-14.34.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.3~dev7-12.31.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.28.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-glance | 15.0.3~dev3-12.31.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.33.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev6-14.36.6 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ironic | 9.1.8~dev8-12.33.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-keystone | 12.0.4~dev11-11.35.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.32.2 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-manila | 5.1.1~dev5-12.37.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca | 2.2.2~dev1-11.28.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.28.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-murano | 4.0.2~dev2-12.28.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-neutron | 11.0.9~dev69-13.38.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-nova | 16.1.9~dev92-11.36.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.6~dev3-12.33.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.5~dev4-11.32.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.23.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-trove | 8.0.2~dev2-11.32.3 | SUSE-SU-2021:2554-1 |
| SUSE OpenStack Cloud 7 | crowbar-openstack | 4.0+git.1616146720.44daffca0-9.81.2 | SUSE-SU-2021:1963-1 |
| SUSE OpenStack Cloud 7 | grafana | 6.7.4-1.24.2 | SUSE-SU-2021:1963-1 |
| SUSE OpenStack Cloud 7 | kibana | 4.6.6-9.2 | SUSE-SU-2021:1963-1 |
| SUSE OpenStack Cloud 7 | monasca-installer | 20180608_12.47-16.2 | SUSE-SU-2021:1963-1 |
| SUSE OpenStack Cloud 7 | python-Django | 1.8.19-3.29.1 | SUSE-SU-2021:1963-1 |
| SUSE OpenStack Cloud 7 | python-py | 1.8.1-11.16.2 | SUSE-SU-2021:1963-1 |
| SUSE OpenStack Cloud 7 | rubygem-activerecord-session_store | 0.1.2-3.4.2 | SUSE-SU-2021:1963-1 |
| SUSE HPE Helion OpenStack 8 | ardana-cobbler | 8.0+git.1614096566.e8c2b27-3.44.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | cassandra | 3.11.10-5.3.5 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | documentation-hpe-helion-openstack-user +5 | 8.20210512-1.32.5 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | grafana | 6.7.4-4.18.2 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | kibana | 4.6.6-3.9.2 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-templates | 0.0.0+git.1623056900.7917e18-3.21.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-installer | 20190923_16.32-3.18.2 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | openstack-nova +1 | 16.1.9~dev92-3.48.5 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | python-Django | 1.11.29-3.25.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | python-elementpath | 1.3.1-1.3.2 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | python-eventlet | 0.20.0-6.3.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | python-py | 1.4.34-3.3.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | python-pysaml2 | 4.0.2-5.9.2 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | python-xmlschema | 1.0.18-1.3.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-aodh | 5.1.1~dev7-12.32.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.2~dev3-12.33.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.30.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-cinder | 11.2.3~dev29-14.34.2 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.3~dev7-12.31.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.28.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-glance | 15.0.3~dev3-12.31.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.33.2 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev6-14.36.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ironic | 9.1.8~dev8-12.33.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-keystone | 12.0.4~dev11-11.35.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.32.2 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-manila | 5.1.1~dev5-12.37.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca | 2.2.2~dev1-11.28.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.28.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-murano | 4.0.2~dev2-12.28.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-neutron | 11.0.9~dev69-13.38.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-nova | 16.1.9~dev92-11.36.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.6~dev3-12.33.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.5~dev4-11.32.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.23.3 | SUSE-SU-2021:2554-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-trove | 8.0.2~dev2-11.32.3 | SUSE-SU-2021:2554-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Django | 3.2.7-2.3 | openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 | openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 | openSUSE-SU-2026:11270-1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 | openSUSE-SU-2026:10005-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | python3-olamkit +2 | 1.0.2-1.el8 | ELSA-2022-9341 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 2.2, < 2.2.21 | 2.2.21 | GHSA-rxjp-mfm9-w4wr |
| PyPI | django | >= 3.0, < 3.1.9 | 3.1.9 | GHSA-rxjp-mfm9-w4wr |
| PyPI | django | >= 3.2, < 3.2.1 | 3.2.1 | GHSA-rxjp-mfm9-w4wr |
| PyPI | django | >= 2.2, < 2.2.21 · >= 3.1, < 3.1.9 · >= 3.2, < 3.2.1 | 2.2.21, 3.1.9, 3.2.1 | PYSEC-2021-7 |
Advisories 17
- RHSA-2021:4702 Red Hat Security Advisory: Satellite 6.10 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
- openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
- USN-4932-2 python-django vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- RHSA-2021:5070 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-django20) security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-3744-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2651-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4932-1 python-django vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2554-1 Security update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1962-1 Security update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1963-1 Security update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2022-9341 Important: ol-automation-manager security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 27, 2022
References
- https://groups.google.com/forum/#%21forum/django-announce
- https://docs.djangoproject.com/en/3.2/releases/security/
- http://www.openwall.com/lists/oss-security/2021/05/04/3
- https://www.djangoproject.com/weblog/2021/may/04/security-releases/
- [debian-lts-announce] 20210506 [SECURITY] [DLA 2651-1] python-django security update mailing-list
- FEDORA-2021-01044b8a59 vendor-advisory
- https://security.netapp.com/advisory/ntap-20210618-0001/
- FEDORA-2022-e7fd530688 vendor-advisory
- https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d
- https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48
- https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007