Bug 1181379 - (CVE-2021-3281) VUL-0: CVE-2021-3281: python-Django1,python-Django: Potential directory-traversal via archive.extract()
(CVE-2021-3281)
VUL-0: CVE-2021-3281: python-Django1,python-Django: Potential directory-trave...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/276229/
CVSSv3.1:SUSE:CVE-2021-3281:6.8:(AV:N...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-01-25 18:02 UTC by Wolfgang Frisch
Modified: 2022-04-14 15:42 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 8 Robert Frohl 2021-02-01 12:37:01 UTC
public via oss-security:


https://www.djangoproject.com/weblog/2021/feb/01/security-releases/

In accordance with `our security release policy <https://docs.djangoproject.com/en/dev/internals/security/>`_, the Django team is issuing
`Django 3.1.6 <https://docs.djangoproject.com/en/dev/releases/3.1.6/>`_,
`Django 3.0.12 <https://docs.djangoproject.com/en/dev/releases/3.0.12/>`_ and
`Django 2.2.18 <https://docs.djangoproject.com/en/dev/releases/2.2.18/>`_.
These releases address the security issue with severity "low" detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2021-3281: Potential directory-traversal via ``archive.extract()``
======================================================================

The ``django.utils.archive.extract()`` function, used by
``startapp --template`` and ``startproject --template``, allowed
directory-traversal via an archive with absolute paths or relative paths with
dot segments.

Thank you to Wang Baohua for the report.

Affected supported versions
===========================

* Django master branch
* Django 3.2 (currently at alpha status)
* Django 3.1
* Django 3.0
* Django 2.2

Resolution
==========

Patches to resolve the issue have been applied to Django's master branch and
the 3.2, 3.1, 3.0, and 2.2 release branches. The patches may be obtained from the following changesets:

* On the `master branch <https://github.com/django/django/commit/05413afa8c18cdb978fcdf470e09f7a12b234a23>`__
* On the `3.2 release branch <https://github.com/django/django/commit/f944f79e555c91571192022a6bb9ddf2178db7ed>`__
* On the `3.1 release branch <https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef435f624>`__
* On the `3.0 release branch <https://github.com/django/django/commit/52e409ed17287e9aabda847b6afe58be2fa9f86a>`__
* On the `2.2 release branch <https://github.com/django/django/commit/21e7622dec1f8612c85c2fc37fe8efbfd3311e37>`__

The following releases have been issued:

* Django 3.1.6 (`download Django 3.1.6 <https://www.djangoproject.com/m/releases/3.1/Django-3.1.6.tar.gz>`_ | `3.1.6 checksums <https://www.djangoproject.com/m/pgp/Django-3.1.6.checksum.txt>`_)
* Django 3.0.12 (`download Django 3.0.12 <https://www.djangoproject.com/m/releases/3.0/Django-3.0.12.tar.gz>`_ | `3.0.12 checksums <https://www.djangoproject.com/m/pgp/Django-3.0.12.checksum.txt>`_)
* Django 2.2.18 (`download Django 2.2.18 <https://www.djangoproject.com/m/releases/2.2/Django-2.2.18.tar.gz>`_ | `2.2.18 checksums <https://www.djangoproject.com/m/pgp/Django-2.2.18.checksum.txt>`_)

The PGP key ID used for this release is Mariusz Felisiak: `2EF56372BA48CD1B <https://github.com/felixxm.gpg>`_.

General notes regarding security reporting
==========================================

As always, we ask that potential security issues be reported via
private email to ``security@djangoproject.com``, and not via Django's
Trac instance or the django-developers list. Please see `our security
policies <https://www.djangoproject.com/security/>`_ for further
information.
Comment 9 Johannes Grassler 2021-02-01 13:29:29 UTC
The python-Django packages in our upstream repositories are patched now:

https://build.opensuse.org/package/show/Cloud:OpenStack:Newton/python-Django
https://build.opensuse.org/package/show/Cloud:OpenStack:Pike/python-Django
https://build.opensuse.org/package/show/Cloud:OpenStack:Rocky/python-Django1

Updated packages for SUSE OpenStack Cloud will become available with the next maintenance updates as they make their way through QA.
Comment 12 Swamp Workflow Management 2021-02-09 17:17:01 UTC
SUSE-RU-2021:0351-1: An update that solves three vulnerabilities, contains 77 features and has four fixes is now available.

Category: recommended (important)
Bug References: 1048688,1164838,1177611,1179189,1179955,1180916,1181379
CVE References: CVE-2016-8611,CVE-2020-10743,CVE-2021-3281
JIRA References: SCRD-7737,SCRD-8255,SCRD-8294,SCRD-8462,SCRD-8705,SOC-10001,SOC-10010,SOC-10133,SOC-10150,SOC-10173,SOC-10191,SOC-10233,SOC-10288,SOC-10339,SOC-10348,SOC-10373,SOC-10378,SOC-10440,SOC-10453,SOC-10456,SOC-10549,SOC-10550,SOC-10623,SOC-10633,SOC-10636,SOC-10658,SOC-10660,SOC-10717,SOC-10740,SOC-10835,SOC-10844,SOC-10874,SOC-10877,SOC-10883,SOC-10887,SOC-10899,SOC-10952,SOC-11000,SOC-11006,SOC-11023,SOC-11028,SOC-11039,SOC-11052,SOC-11077,SOC-11079,SOC-11103,SOC-11117,SOC-11118,SOC-11119,SOC-11141,SOC-11176,SOC-11179,SOC-11190,SOC-11238,SOC-11240,SOC-11243,SOC-11248,SOC-11274,SOC-11286,SOC-11333,SOC-11429,SOC-5270,SOC-6354,SOC-7364,SOC-9288,SOC-9297,SOC-9298,SOC-9631,SOC-9632,SOC-9633,SOC-9636,SOC-9683,SOC-9695,SOC-9766,SOC-9767,SOC-9799,SOC-9849
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    crowbar-ha-5.0+git.1610564036.b75ee1b-3.35.1, crowbar-openstack-5.0+git.1610402513.08dca931e-4.49.1, kibana-4.6.3-3.6.1, openstack-neutron-11.0.9~dev69-3.40.1, openstack-neutron-doc-11.0.9~dev69-3.40.1, openstack-nova-16.1.9~dev78-3.45.1, openstack-nova-doc-16.1.9~dev78-3.45.1, python-Django-1.11.29-3.22.1, release-notes-suse-openstack-cloud-8.20201214-3.29.1, sleshammer-0.8.0-0.20.2, spark-1.6.3-8.6.1
SUSE OpenStack Cloud 8 (src):    ardana-horizon-8.0+git.1610733160.0f577f4-3.21.1, ardana-logging-8.0+git.1610573640.452aed1-3.27.1, ardana-monasca-8.0+git.1610740501.5dca121-3.27.1, ardana-mq-8.0+git.1605176800.52cccfa-3.29.1, ardana-osconfig-8.0+git.1610643571.91b88d6-3.52.1, kibana-4.6.3-3.6.1, openstack-neutron-11.0.9~dev69-3.40.1, openstack-neutron-doc-11.0.9~dev69-3.40.1, openstack-nova-16.1.9~dev78-3.45.1, openstack-nova-doc-16.1.9~dev78-3.45.1, python-Django-1.11.29-3.22.1, release-notes-suse-openstack-cloud-8.20201214-3.29.1, spark-1.6.3-8.6.1, venv-openstack-horizon-12.0.5~dev6-14.34.3, venv-openstack-neutron-11.0.9~dev69-13.36.1, venv-openstack-nova-16.1.9~dev78-11.34.1
HPE Helion Openstack 8 (src):    ardana-horizon-8.0+git.1610733160.0f577f4-3.21.1, ardana-logging-8.0+git.1610573640.452aed1-3.27.1, ardana-monasca-8.0+git.1610740501.5dca121-3.27.1, ardana-mq-8.0+git.1605176800.52cccfa-3.29.1, ardana-osconfig-8.0+git.1610643571.91b88d6-3.52.1, kibana-4.6.3-3.6.1, openstack-neutron-11.0.9~dev69-3.40.1, openstack-neutron-doc-11.0.9~dev69-3.40.1, openstack-nova-16.1.9~dev78-3.45.1, openstack-nova-doc-16.1.9~dev78-3.45.1, python-Django-1.11.29-3.22.1, release-notes-hpe-helion-openstack-8.20201214-3.29.1, spark-1.6.3-8.6.1, venv-openstack-horizon-hpe-12.0.5~dev6-14.34.1, venv-openstack-neutron-11.0.9~dev69-13.36.1, venv-openstack-nova-16.1.9~dev78-11.34.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2021-02-17 20:16:11 UTC
SUSE-RU-2021:0497-1: An update that solves one vulnerability, contains one feature and has 7 fixes is now available.

Category: recommended (important)
Bug References: 1048688,1149535,1179189,1179955,1180507,1181040,1181379,1181521
CVE References: CVE-2021-3281
JIRA References: SOC-11429
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    crowbar-core-6.0+git.1611320924.849e748ff-3.34.1, crowbar-openstack-6.0+git.1610402342.21499240d-3.31.1, kibana-4.6.3-4.6.1, openstack-dashboard-14.1.1~dev10-3.21.3, openstack-manila-7.4.2~dev60-4.33.2, openstack-neutron-13.0.8~dev147-3.34.2, openstack-neutron-gbp-12.0.1~dev16-3.22.2, openstack-nova-18.3.1~dev78-3.34.2, python-Django1-1.11.29-3.18.2, release-notes-suse-openstack-cloud-9.20201214-3.27.2, sleshammer-0.9.0-7.6.1
SUSE OpenStack Cloud 9 (src):    ardana-db-9.0+git.1611600773.5f1de5f-3.22.1, ardana-horizon-9.0+git.1610491814.38661c2-3.16.1, ardana-logging-9.0+git.1610490922.d5f9813-3.16.1, ardana-monasca-9.0+git.1610547641.d79ecfd-3.22.1, ardana-opsconsole-ui-9.0+git.1611867924.eb82818-4.16.1, ardana-osconfig-9.0+git.1610634027.5934cf8-3.25.1, kibana-4.6.3-4.6.1, openstack-dashboard-14.1.1~dev10-3.21.3, openstack-manila-7.4.2~dev60-4.33.2, openstack-neutron-13.0.8~dev147-3.34.2, openstack-neutron-gbp-12.0.1~dev16-3.22.2, openstack-nova-18.3.1~dev78-3.34.2, python-Django1-1.11.29-3.18.2, release-notes-suse-openstack-cloud-9.20201214-3.27.2, venv-openstack-horizon-14.1.1~dev10-4.25.2, venv-openstack-manila-7.4.2~dev60-3.27.2, venv-openstack-neutron-13.0.8~dev147-6.25.2, venv-openstack-nova-18.3.1~dev78-3.25.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2021-06-11 16:20:19 UTC
SUSE-SU-2021:1963-1: An update that fixes 10 vulnerabilities, contains one feature is now available.

Category: security (moderate)
Bug References: 1044849,1179805,1181379,1183803,1184148,1185623,1186608,1186611
CVE References: CVE-2017-11481,CVE-2017-11499,CVE-2019-25025,CVE-2020-29651,CVE-2021-27358,CVE-2021-28658,CVE-2021-31542,CVE-2021-3281,CVE-2021-33203,CVE-2021-33571
JIRA References: SOC-11435
Sources used:
SUSE OpenStack Cloud 7 (src):    crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2, grafana-6.7.4-1.24.2, kibana-4.6.6-9.2, monasca-installer-20180608_12.47-16.2, python-Django-1.8.19-3.29.1, python-py-1.8.1-11.16.2, rubygem-activerecord-session_store-0.1.2-3.4.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Gabriele Sonnu 2022-04-14 15:42:29 UTC
Done.