[ASA-202102-18] python-django: directory traversal

[Remi Gacogne]

Arch Linux Security Advisory ASA-202102-18
==========================================

Severity: Low
Date    : 2021-02-07
CVE-ID  : CVE-2021-3281
Package : python-django
Type    : directory traversal
Remote  : No
Link    : https://security.archlinux.org/AVG-1518

Summary
=======

The package python-django before version 3.1.6-1 is vulnerable to
directory traversal.

Resolution
==========

Upgrade to 3.1.6-1.

# pacman -Syu "python-django>=3.1.6-1"

The problem has been fixed upstream in version 3.1.6.

Workaround
==========

None.

Description
===========

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6,
the django.utils.archive.extract method (used by "startapp --template"
and "startproject --template") allows directory traversal via an
archive with absolute paths or relative paths with dot segments.

Impact
======

An attacker might be able to write files in arbitrary file system
locations by tricking the user to select a crafted template file that
leads to directory traversal.

References
==========

https://www.djangoproject.com/weblog/2021/feb/01/security-releases/
https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef435f624
https://security.archlinux.org/CVE-2021-3281

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210212/e505b5d5/attachment-0001.sig>