Path to dependency file: /wagtail/wagtail/project_template/requirements.txt
Path to vulnerable library: /teSource-ArchiveExtractor_6a8a4d3e-1a25-411e-895f-d18400c71569/20190823195740_81768/20190823195722_depth_0/1/Django-2.2.4.tar/Django-2.2.4
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
CVE-2021-33571 - High Severity Vulnerability
A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/19/11/3449a2071df9427e7a5c4dddee2462e88840dd968a9b0c161097154fcb0c/Django-2.2.4.tar.gz
Path to dependency file: /wagtail/wagtail/project_template/requirements.txt
Path to vulnerable library: /teSource-ArchiveExtractor_6a8a4d3e-1a25-411e-895f-d18400c71569/20190823195740_81768/20190823195722_depth_0/1/Django-2.2.4.tar/Django-2.2.4
Dependency Hierarchy: - :x: **Django-2.2.4.tar.gz** (Vulnerable Library)
Found in base branch: master
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
Publish Date: 2021-06-08
URL: CVE-2021-33571
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.djangoproject.com/weblog/2021/jun/02/security-releases/
Release Date: 2021-06-08
Fix Resolution: Django - 2.2.24, 3.1.12, 3.2.4
Step up your Open Source Security Game with Mend here