Stay Secure with the Latest Linux Advisories

security advisorysecurity updatedirectory traversal

Red Hat OpenStack 16.1 RHSA-2021:5070 Moderate: python-django20 Threats

An update for python-django20 is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenStack Platform 16.1 (python-django20) security update Advisory ID: RHSA-2021:5070-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:5070 Issue date: 2021-12-09 CVE Names: CVE-2021-3281 CVE-2021-28658 CVE-2021-31542 CVE-2021-33203 CVE-2021-33571 ==================================================================== 1. Summary: An update for python-django20 is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 16.1 - noarch 3. Description: Security Fix(es): * Potential directory-traversal via archive.extract() (CVE-2021-3281) * potential directory-traversal via uploaded files (CVE-2021-28658) * Potential directory-traversal via uploaded files (CVE-2021-31542) * Potential directory traversal via ``admindocs`` (CVE-2021-33203) * Possible indeterminate SSRF RFI and LFI attacks since validators accepted leading zeros in IPv4 addresses (CVE-2021-33571) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in thisadvisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1919969 - CVE-2021-3281 django: Potential directory-traversal via archive.extract() 1944801 - CVE-2021-28658 django: potential directory-traversal via uploaded files 1954294 - CVE-2021-31542 django: Potential directory-traversal via uploaded files 1966251 - CVE-2021-33203 django: Potential directory traversal via ``admindocs`` 1966253 - CVE-2021-33571 django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses 6. Package List: Red Hat OpenStack Platform 16.1: Source: python-django20-2.0.13-16.el8ost.1.src.rpm noarch: python-django20-bash-completion-2.0.13-16.el8ost.1.noarch.rpm python3-django20-2.0.13-16.el8ost.1.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-3281 https://access.redhat.com/security/cve/CVE-2021-28658 https://access.redhat.com/security/cve/CVE-2021-31542 https://access.redhat.com/security/cve/CVE-2021-33203 https://access.redhat.com/security/cve/CVE-2021-33571 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYbK/gNzjgjWX9erEAQjBNQ/8DJRQgvZtDZfhcoxXdjxkniaBdSgmL1+B 5XJUhsLYAiExJYeQGHSduXmrxm6D9j6yFh6o4Xiv/sHMNPguxwVhuJJElqnimnJA +/XVKn3HFYnahpUTgyYXiXI3WYLIUSlg7zuS3PY4iOgyQ6PFvWT7N6LiJPGcPgrt CZbCKWW3qx1JV+D066+kOMDSy/Y46idV0fnabrsc1Waf1RzY733HtR0psp5Smau/ CZSiBUhYHj/iW/P0HnudYEQ7VWOMbGnVMXUf77tJ6B2JEdmntPPuj2kXaW33uJNy ReKOn4fX2RQShHaIZiDLf9ihqyIm1pjbJh2hHe+8cFYZnnJ8yjwZGP9g5Dtmq7HA hpiln1uppb/qrysVHeC7q69yqym0uvRHr7eytenRNiRu5lFV5AB+Xt8tJ+UnELUf 71MEZ6jBR0/IOV9y6/AAxI+x2n1Uq3Eq/xZIz9ks/yHfxUlPvioculDio0kCiP7r LdpzFbLFmmgra/0C2XeFavzjHyHVEjtSj9imeQE/YDeMyxja5rYhzQgyJyLSQ4+3 ClJ8/RLRzlY3fr3LsobKGL+yhYwNJmeO/szzgbNZb1u/7IrB8IMMuMJmJzzHKwdH QwKFvUDcYA48uwf5Fg7PgetUo60Ko60fufA3jFV6LG9fgCmWLwuLgthQE2AFs0vz DsqspQFJQFU=MQJi -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . A patch for python-django20 within Red Hat OpenStack Platform 16.1, targeting significant security vulnerabilities and risks.. RedHat OpenStack Security Update, python-django20 Advisory, Moderate Security Impact. . LinuxSecurity.com Team

Dec 09, 2021 Red Hat