CVE-2021-3281

Description

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

How to fix CVE-2021-3281

To remediate CVE-2021-3281, upgrade the affected package to a fixed version below.

• Bitnami/django—upgrade to 2.2.18 or later
• —upgrade to 2:2.2.18-1 or later
• —upgrade to 1:1.10.7-2+deb9u10 or later
• —upgrade to 2.2.18 or later
• —upgrade to 2.2.18 or later

Is CVE-2021-3281 being exploited?

Moderate — EPSS is 41.5%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (5)

• >= 2.2.0, < 2.2.18, >= 3.0.0, < 3.0.12, >= 3.1.0, < 3.1.6
• from 0, < 2:2.2.18-1
• from 0, < 1:1.10.7-2+deb9u10
• >= 2.2, < 2.2.18
• >= 2.2, < 2.2.18, >= 3.0, < 3.0.12, >= 3.1, < 3.1.6

CVSS scores

References (21)

• ADVISORYgithub.com/advisories/GHSA-fvgf-6h6h-3322
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-3281
• ADVISORYsecurity.netapp.com/advisory/ntap-20210226-0004/
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-3281
• ADVISORY