CVE-2021-31542
Summary
| CVE | CVE-2021-31542 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-05-05 15:15:00 UTC |
|---|
| Updated | 2023-12-07 22:15:00 UTC |
|---|
| Description | In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| oss-security - Django 3.2.1, 3.1.9, and 2.2.21: CVE-2021-31542: Potential
directory-traversal via uploaded files |
MISC |
www.openwall.com |
|
| github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d |
|
github.com |
|
| [SECURITY] Fedora 35 Update: python-django-3.2.12-1.fc35 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Redirecting to Google Groups |
|
groups.google.com |
|
| Django security releases issued: 3.2.1, 3.1.9, and 2.2.21 | Weblog | Django |
MISC |
www.djangoproject.com |
|
| github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007 |
|
github.com |
|
| Redirecting to Google Groups |
MISC |
groups.google.com |
|
| Archive of security issues | Django documentation | Django |
MISC |
docs.djangoproject.com |
|
| [SECURITY] [DLA 2651-1] python-django security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 34 Update: python-django-3.1.9-1.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| CVE-2021-31542 Django Vulnerability in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| [SECURITY] Fedora 35 Update: python-django-3.2.12-1.fc35 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: python-django-3.1.9-1.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48 |
|
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159768 Oracle Enterprise Linux Security Update for ol-automation-manager (ELSA-2022-9341)
- 178583 Debian Security Update for python-django (DLA 2651-1)
- 179623 Debian Security Update for python-django (CVE-2021-31542)
- 198351 Ubuntu Security Notification for Django vulnerability (USN-4932-1)
- 239895 Red Hat Update for Satellite 6.10 (RHSA-2021:4702)
- 239944 Red Hat Update for OpenStack Platform 16.1 (RHSA-2021:5070)
- 239947 Red Hat Update for OpenStack Platform 16.1
- 239950 Red Hat Update for OpenStack Platform 16.1
- 239953 Red Hat Update for OpenStack Platform 16.1
- 239955 Red Hat Update for OpenStack Platform 16.1
- 239959 Red Hat Update for OpenStack Platform 16.1
- 281191 Fedora Security Update for python (FEDORA-2021-01044b8a59)
- 282363 Fedora Security Update for python (FEDORA-2022-e7fd530688)
- 296068 Oracle Solaris 11.4 Support Repository Update (SRU) 34.94.4 Missing (CPUAPR2021)
- 6000500 Debian Security Update for python-django (DLA 3744-1)
- 690149 Free Berkeley Software Distribution (FreeBSD) Security Update for django (1766359c-ad6e-11eb-b2a4-080027e50e6d)
- 982083 Python (pip) Security Update for Django (GHSA-rxjp-mfm9-w4wr)
