CVE-2021-31542

Description (CNA)

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Affected (CNA)

CWE

No CWE identifiers supplied.

References

• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/3.2/releases/security/
• http://www.openwall.com/lists/oss-security/2021/05/04/3
• https://www.djangoproject.com/weblog/2021/may/04/security-releases/
• https://lists.debian.org/debian-lts-announce/2021/05/msg00005.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/
• https://security.netapp.com/advisory/ntap-20210618-0001/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
• https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d
• https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48
• https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007

ADP enrichment