CVE-2021-33571
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 5.3%
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
Produtos afetados
n/a · n/aReferências
https://docs.djangoproject.com/en/3.2/releases/security/https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118ehttps://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3dhttps://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fchttps://groups.google.com/g/django-announce/c/sPyjSKMi8Eohttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20210727-0004/https://www.djangoproject.com/weblog/2021/jun/02/security-releases/