CVE-2021-3281

2021-02-0207:15:14

Alpine Linux Development Team

security.alpinelinux.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.1%

JSON

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by “startapp --template” and “startproject --template”) allows directory traversal via an archive with absolute paths or relative paths with dot segments.

OSVersionArchitecturePackageVersionFilename
Alpineedge-communitynoarchpy3-django< 3.1.6-r0UNKNOWN
Alpine3.13-communitynoarchpy3-django< 3.1.6-r0UNKNOWN
Alpine3.14-communitynoarchpy3-django< 3.1.6-r0UNKNOWN
Alpine3.15-communitynoarchpy3-django< 3.1.6-r0UNKNOWN
Alpine3.16-communitynoarchpy3-django< 3.1.6-r0UNKNOWN
Alpine3.17-communitynoarchpy3-django< 3.1.6-r0UNKNOWN
Alpine3.18-communitynoarchpy3-django< 3.1.6-r0UNKNOWN
Alpine3.19-communitynoarchpy3-django< 3.1.6-r0UNKNOWN
Alpine3.20-communitynoarchpy3-django< 3.1.6-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN
Alpine	3.13-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN
Alpine	3.14-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN
Alpine	3.15-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN
Alpine	3.16-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN
Alpine	3.17-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN
Alpine	3.18-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN
Alpine	3.19-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN
Alpine	3.20-community	noarch	py3-django	< 3.1.6-r0	UNKNOWN