REDHAT-BUG-2400450: High severity Django Django vulnerability
The django.utils.archive.extract() function, used by startapp --template and startproject --template, allowed partial directory-traversal via an archive with file paths sharing a common prefix with the target directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2400450?
REDHAT-BUG-2400450 is classified as a high severity vulnerability due to its potential to allow unauthorized file system access.
How do I fix REDHAT-BUG-2400450?
Fixing REDHAT-BUG-2400450 involves updating to the latest patched version of Django that addresses the directory traversal issue.
What are the potential impacts of REDHAT-BUG-2400450?
The potential impacts of REDHAT-BUG-2400450 include unauthorized access to sensitive files and the possibility of code execution.
Is my version of Django vulnerable to REDHAT-BUG-2400450?
If you are using an older version of Django that allows directory traversal through the archive extraction function, your version may be vulnerable to REDHAT-BUG-2400450.
What mitigation strategies exist for REDHAT-BUG-2400450?
Mitigation strategies for REDHAT-BUG-2400450 include restricting user access to the Django app and ensuring that the application does not use vulnerable features until a fix is applied.