CVE-2021-33571 Information

Description

In Django 2.2 before 2.2.24 3.x before 3.1.12 and 3.2 before 3.2.4 URLValidator validate_ipv4_address and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Reference

https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo https://docs.djangoproject.com/en/3.2/releases/security/ https://www.djangoproject.com/weblog/2021/jun/02/security-releases/ https://security.netapp.com/advisory/ntap-20210727-0004/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

7.5