In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "star...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 python-django

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.18-1"}]}]

Debian:13 python-django

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.18-1"}]}]

Debian:14 python-django

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.18-1"}]}]

参照URL

advisory security-tracker.debian.org