tocsin

CVE-2021-33571

2 advisories.

PyPI/django CVE-2021-33571: high 7.5

Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

Action: Upgrade django to 2.2.24 or later.

pip install django==2.2.24
pip install django==3.1.12
pip install django==3.2.4

Affected

introducedfixedlast affected
2.2a12.2.24-
3.0a13.1.12-
3.2a13.2.4-

Fixed versions

2.2.243.1.123.2.4

Sources

CVE-2021-33571 · published · modified · JSON

PyPI/django CVE-2021-33571: unknown

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This ma

Action: Upgrade django to 2.2.24 or later.

pip install django==2.2.24
pip install django==3.1.12
pip install django==3.2.4

Affected

introducedfixedlast affected
2.22.2.24-
3.03.1.12-
3.23.2.4-

Fixed versions

2.2.243.1.123.2.4

Sources

CVE-2021-33571 · published · modified · JSON