PYSEC-2021-9

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2021-9.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2021-9

Aliases

Published

2021-02-02T07:15:00Z

Modified

2023-12-06T00:46:14.322728Z

Summary

[none]

Details

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

References

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2

Fixed

2.2.18

Introduced

3.0

Fixed

3.0.12

Introduced

3.1

Fixed

3.1.6

Affected versions

2.*

2.2

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2.10

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

3.*

3.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.1

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5