CVE-2021-3281

Advisory

Django 2.2.18, 3.0.12 and 3.1.6 include a fix for CVE-2021-3281: The django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

==========================

*February 1, 2021*

Django 3.1.6 fixes a security issue with severity "low" and a bug in 3.1.5.

CVE-2021-3281: Potential directory-traversal via ``archive.extract()``
======================================================================

The ``django.utils.archive.extract()`` function, used by
:option:`startapp --template` and :option:`startproject --template`, allowed
directory-traversal via an archive with absolute paths or relative paths with
dot segments.

Bugfixes
========

* Fixed an admin layout issue in Django 3.1 where changelist filter controls
would become squashed (:ticket:`32391`).


==========================

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3281
• https://docs.djangoproject.com/en/3.1/releases/security/
• https://www.djangoproject.com/weblog/2021/feb/01/security-releases/
• https://groups.google.com/forum/#!forum/django-announce
• https://lists.fedoraproject.org/archives/list/[email protected]/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
• https://security.netapp.com/advisory/ntap-20210226-0004/