CVE-2021-33571: SSRF
:class:~django.core.validators.URLValidator, :func:~django.core.validators.validateipv4address, and :func:~django.core.validators.validateipv46address didn't prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks.
:func:~django.core.validators.validateipv4address and :func:~django.core.validators.validateipv46address validators were not affected on Python 3.9.5+.
Other sources
A flaw was found in django. Leading zeros in octal literals aren't prohibited in IP addresses. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. The highest threat from this vulnerability is to data integrity.
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validateipv4address and validateipv46address are unaffected with Python 3.9.5+..) .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python-django20to a version that resolves this vulnerability.Fixed in 0:2.0.13-16.el8 - Upgrade
Upgrade
redhat/python3-djangoto a version that resolves this vulnerability.Fixed in 0:2.2.24-1.el7 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 3.2.4 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 3.1.12 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 2.2.24 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.2.4 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.1.12 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.2.24 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.1.13-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 2.2.24 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 3.1.12 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 3.2.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-33571.
What is the severity of CVE-2021-33571?
The severity of CVE-2021-33571 is high with a CVSS score of 7.5.
What is the affected software?
The affected software is Django versions 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4.
How does the vulnerability affect access control based on IP addresses?
The vulnerability allows a bypass of access control that is based on IP addresses.
How do I fix CVE-2021-33571?
To fix CVE-2021-33571, update Django to version 3.2.4, 3.1.12, or 2.2.24, depending on the installed version.