PT-2021-3618 · Django+3 · Django+3

Wang Baohua · Published 2021-02-01 · Updated 2024-03-06 · CVE-2021-3281

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 2.2 before 2.2.18 Django versions 3.0 before 3.0.12 Django versions 3.1 before 3.1.6

Description The issue is related to the django.utils.archive.extract method, which is used by "startapp --template" and "startproject --template". This method allows directory traversal via an archive with absolute paths or relative paths with dot segments. The vulnerability may allow a remote attacker to impact data integrity.

Recommendations For Django versions 2.2 before 2.2.18, update to version 2.2.18 or later. For Django versions 3.0 before 3.0.12, update to version 3.0.12 or later. For Django versions 3.1 before 3.1.6, update to version 3.1.6 or later. As a temporary workaround, consider disabling the django.utils.archive.extract method until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-03754

BIT-DJANGO-2021-3281

CVE-2021-3281

DLA-2540-1

DLA-3164-1

GHSA-FVGF-6H6H-3322

PYSEC-2021-9

RHSA-2021:0781

RHSA-2021:3490

RHSA-2021:5070

SUSE-RU-2021:0351-1

SUSE-RU-2021:0497-1

SUSE-SU-2021:1963-1

USN-4715-1

USN-4715-2

Affected Products

Astra Linux

Django

Linuxmint

Ubuntu

References · 80

• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3281 · Security Note
• https://osv.dev/vulnerability/BIT-django-2021-3281 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4715-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4715-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO · Vendor Advisory
• https://djangoproject.com/weblog/2021/feb/01/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3281 · Security Note
• https://ubuntu.com/security/CVE-2021-3281 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2540-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4715-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2021:0351-1 · Vendor Advisory