Path traversal in Django - CVE-2021-3281

Vulnerability identifier: #VU50172

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3281

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences inside archives with "django.utils.archive.extract()" function. A remote attacker can pass specially crafted archive to the application and write files to arbitrary directory on the system.

Django
Arch Linux
Gentoo Linux
Ubuntu
Fedora
Ansible Automation Platform
Red Hat OpenStack
python-galaxy-importer (Red Hat package)
python-pulp-ansible (Red Hat package)
python-bleach-allowlist (Red Hat package)
python-django (Ubuntu package)
python3-django (Ubuntu package)
python-django20 (Red Hat package)
python-django
python-django3
python-bleach (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
dev-python/django

Install update from vendor's website.

Django - addressed in versions 2.2.18, 3.0.12, 3.1.6
python-galaxy-importer (Red Hat package) - addressed in versions 0.2.15-1.el7pc, 0.2.15-1.el8pc
python-pulp-ansible (Red Hat package) - addressed in versions 0.5.6-1.el7pc, 0.5.6-1.el8pc
python-bleach-allowlist (Red Hat package) - addressed in versions 1.0.3-1.el7pc, 1.0.3-1.el8pc
python-django (Ubuntu package) - addressed in versions 1.6.11-0ubuntu1.3+esm2, 1.8.7-1ubuntu5.14, 1:1.11.11-1ubuntu1.10
python3-django (Ubuntu package) - addressed in versions 1.8.7-1ubuntu5.14, 1:1.11.11-1ubuntu1.10, 2:2.2.12-1ubuntu0.3, 2:2.2.16-1ubuntu0.1
python-django20 (Red Hat package) - update to 2.0.13-16.el8ost.1
python-django - update to 3.0.12-1.fc33
python-django3 - update to 3.2.15-1.fc38
python-bleach (Red Hat package) - addressed in versions 3.3.0-1.el7pc, 3.3.0-1.el8pc
automation-hub (Red Hat package) - addressed in versions 4.2.2-1.el7pc, 4.2.2-1.el8pc
python-galaxy-ng (Red Hat package) - addressed in versions 4.2.2-1.el7pc, 4.2.2-1.el8pc
dev-python/django - update to 5.2.1
Red Hat OpenStack - addressed in versions 16.1, 16.2

• Exploit #6521 - CVE-2021-3281 () (July 5, 2021)

• https://www.djangoproject.com/weblog/2021/feb/01/security-releases/

• Path traversal in Django
• Arch Linux update for python-django
• Multiple vulnerabilities in Red Hat Ansible Automation Platform
• Ubuntu update for python-django
• Ubuntu update for python-django
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Red Hat OpenStack 16.1 packages
• Fedora 33 update for python-django
• Fedora 38 update for python-django3
• Gentoo update for Django