Django-3.2-py3-none-any.whl: 5 vulnerabilities (highest severity is: 7.5)

[dev-mend-for-github-com]

Vulnerable Library - Django-3.2-py3-none-any.whl

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/a8/9b/fe94c509e514f6c227308e81076506eb9d67f2bfb8061ce5cdfbde0432e3/Django-3.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 9822e3f4fab4e90c86d98d83786475df21de8a1e

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Django version)	Remediation Available
CVE-2022-41323	High	7.5	Django-3.2-py3-none-any.whl	Direct	Django - 3.2.16,4.0.8,4.1.2	✅
CVE-2021-33571	High	7.5	Django-3.2-py3-none-any.whl	Direct	3.2.4	✅
CVE-2021-31542	High	7.5	Django-3.2-py3-none-any.whl	Direct	3.2.1	✅
CVE-2021-32052	Medium	6.1	Django-3.2-py3-none-any.whl	Direct	3.2.2	✅
CVE-2021-33203	Medium	4.9	Django-3.2-py3-none-any.whl	Direct	3.2.4	✅

Details

CVE-2022-41323

Vulnerable Library - Django-3.2-py3-none-any.whl

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/a8/9b/fe94c509e514f6c227308e81076506eb9d67f2bfb8061ce5cdfbde0432e3/Django-3.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 9822e3f4fab4e90c86d98d83786475df21de8a1e

Found in base branch: main

Vulnerability Details

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

Publish Date: 2022-10-16

URL: CVE-2022-41323

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41323

Release Date: 2022-10-16

Fix Resolution: Django - 3.2.16,4.0.8,4.1.2

⛑️ Automatic Remediation is available for this issue

CVE-2021-33571

Vulnerable Library - Django-3.2-py3-none-any.whl

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/a8/9b/fe94c509e514f6c227308e81076506eb9d67f2bfb8061ce5cdfbde0432e3/Django-3.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 9822e3f4fab4e90c86d98d83786475df21de8a1e

Found in base branch: main

Vulnerability Details

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

Publish Date: 2021-06-08

URL: CVE-2021-33571

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.djangoproject.com/weblog/2021/jun/02/security-releases/

Release Date: 2021-06-08

Fix Resolution: 3.2.4

⛑️ Automatic Remediation is available for this issue

CVE-2021-31542

Vulnerable Library - Django-3.2-py3-none-any.whl

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/a8/9b/fe94c509e514f6c227308e81076506eb9d67f2bfb8061ce5cdfbde0432e3/Django-3.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 9822e3f4fab4e90c86d98d83786475df21de8a1e

Found in base branch: main

Vulnerability Details

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Publish Date: 2021-05-05

URL: CVE-2021-31542

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.djangoproject.com/weblog/2021/may/04/security-releases/

Release Date: 2021-05-05

Fix Resolution: 3.2.1

⛑️ Automatic Remediation is available for this issue

CVE-2021-32052

Vulnerable Library - Django-3.2-py3-none-any.whl

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/a8/9b/fe94c509e514f6c227308e81076506eb9d67f2bfb8061ce5cdfbde0432e3/Django-3.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 9822e3f4fab4e90c86d98d83786475df21de8a1e

Found in base branch: main

Vulnerability Details

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.

Publish Date: 2021-05-06

URL: CVE-2021-32052

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32052

Release Date: 2021-05-06

Fix Resolution: 3.2.2

⛑️ Automatic Remediation is available for this issue

CVE-2021-33203

Vulnerable Library - Django-3.2-py3-none-any.whl

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/a8/9b/fe94c509e514f6c227308e81076506eb9d67f2bfb8061ce5cdfbde0432e3/Django-3.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 9822e3f4fab4e90c86d98d83786475df21de8a1e

Found in base branch: main

Vulnerability Details

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

Publish Date: 2021-06-08

URL: CVE-2021-33203

CVSS 3 Score Details (4.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.djangoproject.com/weblog/2021/jun/02/security-releases/

Release Date: 2021-06-08

Fix Resolution: 3.2.4

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.