[SECURITY] [DLA 3744-1] python-django security update

Debian LTS Advisory DLA-3744-1 [email protected]
https://www.debian.org/lts/security/ Chris Lamb
February 29, 2024 https://wiki.debian.org/LTS

Package : python-django
Version : 1:1.11.29-1+deb10u11
CVE IDs : CVE-2021-28658 CVE-2021-31542 CVE-2021-33203 CVE-2021-33571
Debian Bugs : 986447 988053 989394

It was discovered that there were a number of issues in Django, a
popular Python-based web development framework:

• CVE-2021-28658: Prevent a directory traversal issue which could
  have been exploited by maliciously crafted filenames. However, the
  built-in upload handlers were not affected by this vulnerability.
  (#986447)

• CVE-2021-31542: Fix a potential directory-traversal vulnerability
  that could have been exploited by uploaded files. The
  MultiPartParser, UploadedFile and FieldFile classes allowed
  directory-traversal via uploaded files with suitably crafted file
  names. In order to mitigate this risk, stricter basename and path
  sanitation is now applied. Specifically, empty file names and
  paths with dot segments are rejected. (#988053)

• CVE-2021-33203: Prevent a potential directory traversal via
  admindocs. Staff members could use the admindocs
  TemplateDetailView view to check the existence of arbitrary files.
  Additionally, if (and only if) the default admindocs templates
  have been customized by the developers to also expose the file
  contents, then not only the existence but also the file contents
  would have been exposed. As a mitigation, path sanitation is now
  applied and only files within the template root directories can be
  loaded. (#989394)

• CVE-2021-33571: Prevent possible SSRF, RFI (Remote File Inclusion)
  and LFI (Local File Inclusion) attacks, since validators accepted
  leading zeros in IPv4 addresses URLValidator,
  validate_ipv4_address() and validate_ipv46_address() did not
  prohibit leading zeros in octal literals. (#989394)

For Debian 10 buster, these problems have been fixed in version
1:1.11.29-1+deb10u11.

We recommend that you upgrade your python-django packages.

For the detailed security status of python-django please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-django

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS