Path traversal in Django - CVE-2021-45452

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU59181

Path traversal in Django - CVE-2021-45452

Published: January 4, 2022


Vulnerability identifier: #VU59181
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-45452
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the Storage.save() method. A remote user can pass a specially crafted HTTP filename to the application and write the file outside of the intended directory.


Affected software

Django
Gentoo Linux
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE OpenStack Cloud
Ubuntu
openEuler
Fedora
venv-openstack-octavia-x86_64
venv-openstack-monasca-ceilometer-x86_64
python3-django (Ubuntu package)
python-django (Ubuntu package)
python-Django1
python-Django
venv-openstack-monasca-x86_64
python3-Django
python-django-help
python-django
venv-openstack-swift-x86_64
venv-openstack-murano-x86_64
venv-openstack-freezer-x86_64
venv-openstack-barbican-x86_64
venv-openstack-magnum-x86_64
venv-openstack-designate-x86_64
venv-openstack-manila-x86_64
venv-openstack-aodh-x86_64
dev-python/django
venv-openstack-sahara-x86_64
venv-openstack-trove-x86_64
venv-openstack-ceilometer-x86_64
venv-openstack-heat-x86_64
venv-openstack-ironic-x86_64
venv-openstack-neutron-x86_64
venv-openstack-cinder-x86_64
venv-openstack-keystone-x86_64
venv-openstack-horizon-hpe-x86_64
venv-openstack-horizon-x86_64
venv-openstack-glance-x86_64
venv-openstack-nova-x86_64

How to mitigate CVE-2021-45452

Install update from vendor's website.

Django - addressed in versions 2.2.26, 3.2.11, 4.0.1
venv-openstack-octavia-x86_64 - update to 1.0.6~dev3-12.38.1
venv-openstack-monasca-ceilometer-x86_64 - update to 1.5.1_1.5.1_1.5.1~dev3-8.33.1
python3-django (Ubuntu package) - addressed in versions 1:1.11.11-1ubuntu1.15, 2:2.2.12-1ubuntu0.9, 2:2.2.20-1ubuntu0.4, 2:2.2.24-1ubuntu1.2
python-django (Ubuntu package) - update to 1:1.11.11-1ubuntu1.15
python-Django1 - update to 1.11.29-3.30.1
python-Django - addressed in versions 1.11.29-3.33.1, 1.11.29-3.39.1
venv-openstack-monasca-x86_64 - update to 2.2.2~dev1-11.40.1
python3-Django - addressed in versions 2.2.27-1, 2.2.27-2
python-django-help - addressed in versions 2.2.27-1, 2.2.27-2
python-django - addressed in versions 2.2.27-1, 2.2.27-2
venv-openstack-swift-x86_64 - update to 2.15.2_2.15.2_2.15.2~dev32-11.28.1
python-django - addressed in versions 3.2.12-1.fc35, 4.0.2-1.fc36
venv-openstack-murano-x86_64 - update to 4.0.2~dev2-12.33.1
venv-openstack-freezer-x86_64 - update to 5.0.0.0~xrc2~dev2-10.33.1
venv-openstack-barbican-x86_64 - update to 5.0.2~dev3-12.38.1
venv-openstack-magnum-x86_64 - update to 5.0.2_5.0.2_5.0.2~dev31-11.37.1
venv-openstack-designate-x86_64 - update to 5.0.3~dev7-12.36.1
venv-openstack-manila-x86_64 - update to 5.1.1~dev5-12.42.1
venv-openstack-aodh-x86_64 - update to 5.1.1~dev7-12.37.1
dev-python/django - update to 5.2.1
venv-openstack-sahara-x86_64 - update to 7.0.5~dev4-11.37.1
venv-openstack-trove-x86_64 - update to 8.0.2~dev2-11.37.1
venv-openstack-ceilometer-x86_64 - update to 9.0.8~dev7-12.35.1
venv-openstack-heat-x86_64 - update to 9.0.8~dev22-12.40.1
venv-openstack-ironic-x86_64 - update to 9.1.8~dev8-12.38.1
venv-openstack-neutron-x86_64 - update to 11.0.9~dev69-13.43.1
venv-openstack-cinder-x86_64 - update to 11.2.3~dev29-14.39.1
venv-openstack-keystone-x86_64 - update to 12.0.4~dev11-11.40.1
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.43.2
venv-openstack-horizon-x86_64 - update to 12.0.5~dev6-14.43.2
venv-openstack-glance-x86_64 - update to 15.0.3~dev3-12.36.1
venv-openstack-nova-x86_64 - update to 16.1.9~dev92-11.41.1

External References

Related Security Bulletins