CVE-2021-31542

HIGH7.5EPSS 4.4%

python-django - security update

Published: 6/4/2021Modified: 4/3/2025

Also known as:GHSA-rxjp-mfm9-w4wrBIT-django-2021-31542PYSEC-2021-7

Description

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Affected packages (5)

Bitnami/django>= 2.2.0, < 2.2.21, >= 3.1.0, < 3.1.9, >= 3.2.0, < 3.2.1
Debian/python-djangofrom 0, < 2:2.2.21-1
Debian/python-djangofrom 0, < 1:1.10.7-2+deb9u13
PyPI/django>= 2.2, < 2.2.21
PyPI/django>= 2.2, < 2.2.21, >= 3.1, < 3.1.9, >= 3.2, < 3.2.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (25)

ADVISORYhttps://github.com/advisories/GHSA-rxjp-mfm9-w4wr
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-31542
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-31542
ADVISORYhttps://www.djangoproject.com/weblog/2021/may/04/security-releases/
PATCHhttps://github.com/django/django
WEBhttps://docs.djangoproject.com/en/3.2/releases/security
WEBhttps://docs.djangoproject.com/en/3.2/releases/security/
WEBhttps://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d
WEBhttps://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48
WEBhttps://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-7.yaml
WEBhttps://groups.google.com/forum/#%21forum/django-announce
WEBhttps://groups.google.com/forum/#!forum/django-announce
WEBhttps://lists.debian.org/debian-lts-announce/2021/05/msg00005.html
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/
WEBhttps://security.netapp.com/advisory/ntap-20210618-0001
WEBhttps://security.netapp.com/advisory/ntap-20210618-0001/
WEBhttps://www.djangoproject.com/weblog/2021/may/04/security-releases
WEBhttp://www.openwall.com/lists/oss-security/2021/05/04/3