{"id":"CVE-2021-3281","aliases":["ALPINE-CVE-2021-3281","BIT-django-2021-3281","DEBIAN-CVE-2021-3281","DLA-2540-1","DLA-3164-1","EUVD-2021-0066","GHSA-fvgf-6h6h-3322","PYSEC-2021-9","RHSA-2021:0781","RHSA-2021:3490","RHSA-2021:5070","SUSE-RU-2021:0351-1","SUSE-RU-2021:0497-1","SUSE-SU-2021:1963-1","UBUNTU-CVE-2021-3281","USN-4715-1","USN-4715-2"],"status":"published","title":"Django Directory Traversal via archive.extract","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07605,"percentile":0.9459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2021-02-01T00:00:00Z","modified":"2026-11-03T06:32:34Z","exploits":[{"source":"pocgithub","id":"lwzSoviet/CVE-2021-3281","title":"lwzSoviet/CVE-2021-3281","date":"2021-07-05","url":"https://github.com/lwzSoviet/CVE-2021-3281"}],"fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["2.2.18","3.1.6","3.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["2.2.18","3.0.12","3.1.6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["2:2.2.18-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["2:2.2.18-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["2:2.2.18-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"python-django","fixed_in":["1:1.10.7-2+deb9u10"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-db","fixed_in":["9.0+git.1611600773.5f1de5f-3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-horizon","fixed_in":["9.0+git.1610491814.38661c2-3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-logging","fixed_in":["9.0+git.1610490922.d5f9813-3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-monasca","fixed_in":["9.0+git.1610547641.d79ecfd-3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-opsconsole-ui","fixed_in":["9.0+git.1611867924.eb82818-4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-osconfig","fixed_in":["9.0+git.1610634027.5934cf8-3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"kibana","fixed_in":["4.6.3-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-dashboard","fixed_in":["14.1.1~dev10-3.21.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-manila","fixed_in":["7.4.2~dev60-4.33.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","fixed_in":["13.0.8~dev147-3.34.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","fixed_in":["12.0.1~dev16-3.22.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","fixed_in":["18.3.1~dev78-3.34.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","fixed_in":["1.11.29-3.18.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","fixed_in":["9.20201214-3.27.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","fixed_in":["14.1.1~dev10-4.25.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","fixed_in":["7.4.2~dev60-3.27.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","fixed_in":["13.0.8~dev147-6.25.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","fixed_in":["18.3.1~dev78-3.25.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-core","fixed_in":["6.0+git.1611320924.849e748ff-3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","fixed_in":["6.0+git.1610402342.21499240d-3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kibana","fixed_in":["4.6.3-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-dashboard","fixed_in":["14.1.1~dev10-3.21.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-manila","fixed_in":["7.4.2~dev60-4.33.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","fixed_in":["13.0.8~dev147-3.34.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","fixed_in":["12.0.1~dev16-3.22.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","fixed_in":["18.3.1~dev78-3.34.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","fixed_in":["1.11.29-3.18.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","fixed_in":["9.20201214-3.27.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sleshammer","fixed_in":["0.9.0-7.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","fixed_in":["1.6.11-0ubuntu1.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-django","fixed_in":["1.8.7-1ubuntu5.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-django","fixed_in":["2:2.2.12-1ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"fixed":"2.2.18"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1"},{"fixed":"3.1.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.0.12"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.18"},{"introduced":"3.0.0"},{"fixed":"3.0.12"},{"introduced":"3.1.0"},{"fixed":"3.1.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.7-2+deb9u10"}]}],"versions":["1:1.10.7-2","1:1.10.7-2+deb9u1","1:1.10.7-2+deb9u2","1:1.10.7-2+deb9u3","1:1.10.7-2+deb9u4","1:1.10.7-2+deb9u5","1:1.10.7-2+deb9u6","1:1.10.7-2+deb9u7","1:1.10.7-2+deb9u8","1:1.10.7-2+deb9u9"]},{"source":"osv","ecosystem":"Debian:10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.29-1+deb10u2"}]}],"versions":["1:1.11.21-1","1:1.11.22-1","1:1.11.22-1~deb10u1","1:1.11.23-1~deb10u1","1:1.11.27-1~deb10u1","1:1.11.28-1~deb10u1","1:1.11.29-1~deb10u1"],"bundled":5},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"fixed":"2.2.18"}]}],"versions":["2.2","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1"},{"fixed":"3.1.6"}]}],"versions":["3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.0.12"}]}],"versions":["3.0","3.0.1","3.0.10","3.0.11","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"fixed":"2.2.18"},{"introduced":"3.0"},{"fixed":"3.0.12"},{"introduced":"3.1"},{"fixed":"3.1.6"}]}],"versions":["2.2","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","3.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.0.10","3.0.11","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-bleach-allowlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.15-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.5.6-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-bleach-allowlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.18-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.15-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.5.6-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-bleach-allowlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.15-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.5.6-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-bleach-allowlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.18-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.15-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.5.6-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-django20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-16.el8ost.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-django20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-16.el8ost.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-django20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-16.el8ost.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-django20-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-16.el8ost.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-django20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-16.el8ost.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1610733160.0f577f4-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1610573640.452aed1-3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1610740501.5dca121-3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-mq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1605176800.52cccfa-3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-osconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1610643571.91b88d6-3.52.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev78-3.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev78-3.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"release-notes-hpe-helion-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20201214-3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-8.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-horizon-hpe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-14.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-13.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev78-11.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1610733160.0f577f4-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1610573640.452aed1-3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1610740501.5dca121-3.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-mq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1605176800.52cccfa-3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-osconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1610643571.91b88d6-3.52.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev78-3.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev78-3.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20201214-3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-8.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-14.34.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-13.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev78-11.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"crowbar-ha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0+git.1610564036.b75ee1b-3.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0+git.1610402513.08dca931e-4.49.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev78-3.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev78-3.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20201214-3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"sleshammer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-0.20.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-8.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1611600773.5f1de5f-3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1610491814.38661c2-3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1610490922.d5f9813-3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1610547641.d79ecfd-3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-opsconsole-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1611867924.eb82818-4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-osconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1610634027.5934cf8-3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev10-3.21.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-4.33.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev147-3.34.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev16-3.22.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev78-3.34.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.18.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20201214-3.27.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev10-4.25.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.27.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev147-6.25.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev78-3.25.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1611320924.849e748ff-3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1610402342.21499240d-3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev10-3.21.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-4.33.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev147-3.34.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev16-3.22.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev78-3.34.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.18.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20201214-3.27.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sleshammer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0+git.1616146720.44daffca0-9.81.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-1.24.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-9.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180608_12.47-16.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.29.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.16.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activerecord-session_store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-3.4.2"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm2"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.14"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.10"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.3"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.14"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.10"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.3"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm2"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1"]}],"products":[{"vendor":"djangoproject","product":"django"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"snapcenter"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://docs.djangoproject.com/en/3.1/releases/security/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://www.djangoproject.com/weblog/2021/feb/01/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210226-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3281","tags":["web","advisory"]},{"url":"https://github.com/django/django/commit/05413afa8c18cdb978fcdf470e09f7a12b234a23","tags":["web"]},{"url":"https://groups.google.com/forum/#!forum/django-announce","tags":["web"]},{"url":"https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef435f624","tags":["web"]},{"url":"https://github.com/django/django/commit/21e7622dec1f8612c85c2fc37fe8efbfd3311e37","tags":["web"]},{"url":"https://github.com/django/django/commit/52e409ed17287e9aabda847b6afe58be2fa9f86a","tags":["web"]},{"url":"https://docs.djangoproject.com/en/3.1/releases/3.0.12","tags":["web"]},{"url":"https://docs.djangoproject.com/en/3.1/releases/security","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fvgf-6h6h-3322","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-9.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210226-0004","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/feb/01/security-releases","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3281","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3281","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0781","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922136","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0781.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7789","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7789","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-AJV-584908","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3281","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20270","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20270","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20270","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23980","tags":["advisory"]},{"url":"https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940603","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27291","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3490","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1966251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1966253","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3490.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33203","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33203","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33203","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2021/jun/02/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33571","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33571","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5070","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954294","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5070.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28658","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2021/apr/06/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-31542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31542","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2021/may/04/security-releases/","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/-2021-351/suse-ru-20210351-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1048688","tags":["report"]},{"url":"https://bugzilla.suse.com/1164838","tags":["report"]},{"url":"https://bugzilla.suse.com/1177611","tags":["report"]},{"url":"https://bugzilla.suse.com/1179189","tags":["report"]},{"url":"https://bugzilla.suse.com/1179955","tags":["report"]},{"url":"https://bugzilla.suse.com/1180916","tags":["report"]},{"url":"https://bugzilla.suse.com/1181379","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3281","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2021-497/suse-ru-20210497-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149535","tags":["report"]},{"url":"https://bugzilla.suse.com/1180507","tags":["report"]},{"url":"https://bugzilla.suse.com/1181040","tags":["report"]},{"url":"https://bugzilla.suse.com/1181521","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1044849","tags":["report"]},{"url":"https://bugzilla.suse.com/1179805","tags":["report"]},{"url":"https://bugzilla.suse.com/1183803","tags":["report"]},{"url":"https://bugzilla.suse.com/1184148","tags":["report"]},{"url":"https://bugzilla.suse.com/1185623","tags":["report"]},{"url":"https://bugzilla.suse.com/1186608","tags":["report"]},{"url":"https://bugzilla.suse.com/1186611","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-3281","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4715-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4715-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3281","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-02-02T06:16:28Z","modified":"2024-08-03T16:53:17.221Z","updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-0066","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-02-02T06:16:28Z","modified":"2024-08-03T16:53:17Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-fvgf-6h6h-3322","title":"Django Directory Traversal via archive.extract","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-03-18T20:29:49Z","modified":"2024-09-20T15:36:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2021-3281","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-02-02T07:15:14.02Z","modified":"2026-06-17T04:04:53.093Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"ALPINE-CVE-2021-3281","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-02-02T07:15:14.02Z","modified":"2026-11-03T06:32:34.200724339Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-3281","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-02-02T07:15:14.02Z","modified":"2026-10-24T10:30:55.985655966Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-3281","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-02-02T07:15:14.02Z","modified":"2026-10-23T18:03:03.101187604Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-fvgf-6h6h-3322","title":"Django Directory Traversal via archive.extract","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-03-18T20:29:49Z","modified":"2024-09-20T15:46:03.145197Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"RHSA-2021:0781","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 1.2.2 security and bug fix update","status":"published","published":"2024-09-18T04:17:10Z","modified":"2026-06-28T10:42:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:3490","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-django20) security update","status":"published","published":"2024-09-18T04:19:49Z","modified":"2026-06-27T10:14:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:5070","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-django20) security update","status":"published","published":"2024-09-18T04:21:08Z","modified":"2026-06-27T10:14:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2021-3281","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-02-01T10:00:00Z","modified":"2026-02-04T02:18:36.935329Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"BIT-django-2021-3281","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2024-03-06T10:54:53.404Z","modified":"2026-09-08T08:46:22.87583208Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"DLA-2540-1","title":"python-django - security update","status":"published","published":"2021-02-01T00:00:00Z","modified":"2026-03-09T01:22:10.42502Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3164-1","title":"python-django - security update","status":"published","published":"2022-10-27T00:00:00Z","modified":"2026-03-09T01:22:51.844881Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"PYSEC-2021-9","description":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments.","status":"published","published":"2021-02-02T07:15:00Z","modified":"2023-12-06T01:01:15.916389Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-RU-2021:0351-1","title":"Recommended update for ardana-horizon, ardana-logging, ardana-monasca, ardana-mq, ardana-osconfig, crowbar-ha, crowbar-openstack, kibana, openstack-neutron, openstack-nova, python-Django, release-notes-suse-openstack-cloud, sleshammer, spark","description":"This update for ardana-horizon, ardana-logging, ardana-monasca, ardana-mq, ardana-osconfig, crowbar-ha, crowbar-openstack, kibana, openstack-neutron, openstack-nova, python-Django, release-notes-suse-openstack-cloud, sleshammer, spark fixes the following issues:\n\nSecurity fix from this update:\npython-Django1\n- CVE-2021-3281: Fixed a potential directory traversal when extracting\n  archives (bsc#1181379).\n\nChanges in ardana-horizon_Update:\n- Update to version 8.0+git.1610733160.0f577f4:\n  * Add Fix for logfile permissions (bsc#1179189)\n\nChanges in ardana-logging_Update:\n- Update to version 8.0+git.1610573640.452aed1:\n  * Remove some files from upgrade.yml (bsc#1179189)\n\nChanges in ardana-monasca_Update:\n- Update to version 8.0+git.1610740501.5dca121:\n  * Add Fix for logfile permissions (bsc#1179189)\n\nChanges in ardana-mq_Update:\n- Update to version 8.0+git.1605176800.52cccfa:\n  * Re-enable mirroring of fanout and reply queues (bsc#1177611)\n\nChanges in ardana-osconfig_Update:\n- Update to version 8.0+git.1610643571.91b88d6:\n  * Remove SLES-12-SP3-LTSS repos (bsc#1180916)\n\nChanges in crowbar-ha:\n- Update to version 5.0+git.1610564036.b75ee1b:\n  * [5.0] crowbar-pacemaker: Cluster member SSH key improvements\n\nChanges in crowbar-openstack:\n- Update to version 5.0+git.1610402513.08dca931e:\n  * neutron: Fix handling of networks with non-ascii names (SOC-11429)\n\n- Update to version 5.0+git.1610372799.621afb999:\n  * keystone: fix keystone node lookup (SOC-11333, bsc#1164838)\n\nChanges in kibana:\n- Add 0001-Configurable-custom-response-headers-for-server.patch\n (bsc#1171909, CVE-2020-10743)\n\n- Added kibana.yml symlink (bsc#1048688, FATE#323204)\n\n\nChanges in openstack-nova_Update:\n- Update to version nova-16.1.9.dev78:\n  * [stable-only] Cap bandit to 1.6.2\n\nChanges in python-Django_Update:\n- Add CVE-2021-3281.patch (bsc#1181379, CVE-2021-3281)\n  * Fixes a potential directory traversal when extracting archives\n\nChanges in release-notes-suse-openstack-cloud:\n- Fix incorrect issue number for bsc#1179955\n- Update to version 8.20201214:\n  * Add workaround for secure boot issue when shim package is updated. (bsc#1179955)\n\nChanges in spark_Update:\n- Add _constraints to prevent build from running out of disk space.\n\nChanges in sleshammer:\n- Really drop etc/udev/rules.d/70-persistent-net.rules from the overlay\n  it was still present in the tarball. (SOC-9288)\n\n- added ruby2.1-rubygem-crowbar-client providing crowbarctl\n\n","status":"published","published":"2021-02-09T12:22:58Z","modified":"2026-02-04T04:19:07.243581Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2021:0497-1","title":"Recommended update for ardana-db, ardana-horizon, ardana-logging, ardana-monasca, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, crowbar-openstack, kibana, openstack-dashboard, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, release-notes-suse-openstack-cloud, sleshammer","description":"This update for ardana-db, ardana-horizon, ardana-logging, ardana-monasca, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, crowbar-openstack, kibana, openstack-dashboard, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, release-notes-suse-openstack-cloud, sleshammer fixes the following issues:\n\nSecurity fix included in this update:\npython-Django1\n- CVE-2021-3281: Fixed a potential directory traversal when extracting\n  archives (bsc#1181379).\n\nNon-security fixes included in this update\n\nChanges in ardana-db:\n- Update to version 9.0+git.1611600773.5f1de5f:\n  * Add tasks to check for the TLS certificate expiry (bsc#1181040)\n\nChanges in ardana-horizon:\n- Update to version 9.0+git.1610491814.38661c2:\n  * Add Fix for logfile permissions (bsc#1179189)\n\nChanges in ardana-logging:\n- Update to version 9.0+git.1610490922.d5f9813:\n  * Remove some files and fix mysql logs locations (bsc#1179189)\n\nChanges in ardana-monasca:\n- Update to version 9.0+git.1610547641.d79ecfd:\n  * Add Fix for logfile permissions (bsc#1179189)\n\nChanges in ardana-opsconsole-ui:\n- Update to version 9.0+git.1611867924.eb82818:\n  * Adjust period used to query monasca summary metrics (bsc#1181521)\n\nChanges in ardana-osconfig:\n- Update to version 9.0+git.1610634027.5934cf8:\n  * Fix logrotate code that needs to silence the grep (bsc#1179189)\n\nChanges in crowbar-core:\n- Update to version 6.0+git.1611320924.849e748ff:\n  * avoid v4.1.5 of delayed_job_active_record (noref)\n  * add CVE-2020-26247 to travis ignore list (bsc#1180507)\n\nChanges in crowbar-openstack:\n- Update to version 6.0+git.1610402342.21499240d:\n  * neutron: Fix handling of networks with non-ascii names (SOC-11429)\n\n- Update to version 6.0+git.1610374680.e68ff27d2:\n  * Terminate ssl on haproxy for cinder (bsc#1149535)\n  * Terminate ssl on haproxy for nova (bsc#1149535)\n\nChanges in kibana:\n- Added kibana.yml symlink (bsc#1048688, FATE#323204)\nChanges in openstack-dashboard:\n- add 0001-Fix-network_topology-view-memory-and-file-leaks.patch\n\n- Update to version horizon-14.1.1.dev10:\n  * Fix open redirect (OSSA-2020-008, CVE-2020-29565)\n\n- Update to version horizon-14.1.1.dev8:\n  * Cap bandit for python 2.7 env\n\nChanges in openstack-manila:\n- Update to version manila-7.4.2.dev60:\n  * [stable/rocky] Adjust CI jobs\n  * [NetApp] Fix CIFS promote back issue\n\n- Update to version manila-7.4.2.dev58:\n  * [stable/rocky] Adjust CI jobs\n\nChanges in openstack-manila:\n- Update to version manila-7.4.2.dev60:\n  * [stable/rocky] Adjust CI jobs\n  * [NetApp] Fix CIFS promote back issue\n\n- Update to version manila-7.4.2.dev58:\n  * [stable/rocky] Adjust CI jobs\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev147:\n  * Improve DHCP agent's debug messages\n\n- Update to version neutron-13.0.8.dev145:\n  * Use consistent filter API syntax\n\n- Update to version neutron-13.0.8.dev144:\n  * Improve the CIDRs overlap check method for router add interface\n\n- Update to version neutron-13.0.8.dev142:\n  * [GRE] Add possibility to create GRE tunnels over IPv6\n\n- Update to version neutron-13.0.8.dev140:\n  * Fix migration from the HA to non-HA routers\n\n- Update to version neutron-13.0.8.dev138:\n  * Dropping lower constraints testing (stable Rocky)\n  * Fix calling of add\\_tunnel\\_port method from sanity checks module\n\n- Update to version neutron-13.0.8.dev136:\n  * Dropping lower constraints testing (stable Rocky)\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev147:\n  * Improve DHCP agent's debug messages\n\n- Update to version neutron-13.0.8.dev145:\n  * Use consistent filter API syntax\n\n- Update to version neutron-13.0.8.dev144:\n  * Improve the CIDRs overlap check method for router add interface\n\n- Update to version neutron-13.0.8.dev142:\n  * [GRE] Add possibility to create GRE tunnels over IPv6\n\n- Update to version neutron-13.0.8.dev140:\n  * Fix migration from the HA to non-HA routers\n\n- Update to version neutron-13.0.8.dev138:\n  * Dropping lower constraints testing (stable Rocky)\n  * Fix calling of add\\_tunnel\\_port method from sanity checks module\n\n- Update to version neutron-13.0.8.dev136:\n  * Dropping lower constraints testing (stable Rocky)\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-12.0.1.dev16:\n  * [AIM] Add extension for ERSPAN\n  2014.2.rc1\n\n- Update to version group-based-policy-12.0.1.dev15:\n  * Fix QoS unit tests\n  2014.2rc1\n\n- Update to version group-based-policy-12.0.1.dev14:\n  * Fix session handling\n  * Fix DB query call\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev11:\n  * Fix bug where security-group rule config doesn't reflect new VMs addition\n  * Fix DB performance with sessions\n  2014.2rc1\n\n- Update to version group-based-policy-12.0.1.dev8:\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev11:\n  * Fix bug where security-group rule config doesn't reflect new VMs addition\n  * Fix DB performance with sessions\n  2014.2rc1\n\n- Update to version group-based-policy-12.0.1.dev8:\n  * Fix upstream gate\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev7:\n  * Block qos config in floating ip\n  * Fix upstream gate\n  2014.2rc1\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev78:\n  * [stable-only] Cap bandit and make lower-constraints job non-voting\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev78:\n  * [stable-only] Cap bandit and make lower-constraints job non-voting\n\nChanges in python-Django1:\n- Add CVE-2021-3281.patch (bsc#1181379, CVE-2021-3281)\n  * Fixes a potential directory traversal when extracting archives\n\nChanges in release-notes-suse-openstack-cloud:\n- Update to version 9.20201214:\n  * Add workaround for secure boot issue when shim package is updated. Removed deprecated note about Crowbar Octavia plugin. (bsc#1179955)\n","status":"published","published":"2021-02-17T15:00:26Z","modified":"2026-02-04T03:58:00.642664Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2021:1963-1","title":"Security update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store","description":"This update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store contains the following fixes:\n\nSecurity fixes included in this update:\n\n\ncrowbar-openstack:\n- CVE-2016-8611: Added rate limiting for the '/images' API POST method\n(bsc#1005886).\n\ngrafana:\n- CVE-2021-27358: Fixed a denial of service via remote API call\n(bsc#1183803)\n\nkibana:\n- CVE-2017-11499: Fixed a vulnerability in nodejs, related to the\nHashTable implementation, which could cause a denial of service\n(bsc#1044849)\n- CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL\nfields (bsc#1044849)\n\npython-Django:\n- CVE-2021-3281: Fixed a directory traversal via archive.extract()\n(bsc#1181379)\n- CVE-2021-28658: Fixed a directory traversal via uploaded files\n(bsc#1184148)\n- CVE-2021-31542: Fixed a directory traversal via uploaded files with\nsuitably crafted file names (bsc#1185623)\n- CVE-2021-33203:Fixed potential path-traversal via admindocs'\nTemplateDetailView (bsc#1186608)\n- CVE-2021-33571: Tighten validator checks to not allow leading zeros in\nIPv4 addresses, which potentially leads to further attacks (bsc#1186611)\n\npython-py:\n- CVE-2020-29651: Fixed a denial of service via regular expressions\n(bsc#1179805)\n\nrubygem-activerecord-session_store:\n- CVE-2019-25025: Fixed a timing attacks targeting the session id which\ncould allow an attack to hijack sessions (bsc#1183174)\n\n\nNon-security fixes included in this update:\n\nChanges in crowbar-openstack:\n- Update to version 4.0+git.1616146720.44daffca0:\n  * monasca: restart Kibana on update (bsc#1044849)\n\nChanges in grafana_Update:\n- Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358)\n  * Prevent unauthenticated remote attackers from causing a DoS through the\n    snapshots API.\n\nChanges in kibana_Update:\n- Ensure /etc/sysconfig/kibana is present\n\n- Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14,\n  ESA-2017-16)\n  * [4.6] ignore forked code for babel transpile build phase (#13483)\n  * Allow more than match queries in custom filters (#8614) (#10857)\n  * [state] don't make extra $location.replace() calls (#9954)\n  * [optimizer] move to querystring-browser package for up-to-date api\n  * [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls\n  * server: refactor log_interceptor to be more DRY (#9617)\n  * server: downgrade ECANCELED logs to debug (#9616)\n  * server: do not treat logged warnings as errors (#8746) (#9610)\n  * [server/logger] downgrade EPIPE errors to debug level (#9023)\n  * Add basepath when redirecting from a trailling slash (#9035)\n  * [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968)\n  * [server/shortUrl] validate urls before shortening them\n- Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481)\n  * This fixes an XSS vulnerability in URL fields\n- Remove %dir declaration from /opt/kibana/optimize to ensure\n  no files owned by root end up in there\n- Exclude /opt/kibana/optimize from %fdupes\n- Restart service on upgrade\n- Do not copy LICENSE.txt and README.txt to /opt/kibana\n- Fix rpmlint warnings/errors\n- Switch to explicit patch application\n- Fix source URL\n- Fix logic for systemd/systemv detection\n\nChanges in monasca-installer_Update:\n- Add support-influxdb-1.2.patch (SOC-11435)\n\nChanges in python-Django_Update:\n- Fixed potential path-traversal via admindocs' TemplateDetailView.(bsc#1186608, CVE-2021-33203)\n-  Prevented leading zeros in IPv4 addresses. (bsc#1186611, CVE-2021-33571)\n- Add delegate-os-path-filename-generation-to-storage.patch (bsc#1185623)\n    * Needed for CVE-2021-31542.patch to apply\n- Tightened path \u0026 file name sanitation in file uploads. (bsc#1185623, CVE-2021-31542)\n- Fixed potential directory-traversal via uploaded files. (bsc#1184148, CVE-2021-28658)\n- Fixes a potential directory traversal when extracting archives. (bsc#1181379, CVE-2021-3281)\n\nChanges in python-py_Update:\n- Add CVE-2020-29651.patch (CVE-2020-29651, bsc#1179805)\n  * svnwc: fix regular expression vulnerable to DoS in blame functionality\n- Ensure /usr/share/licenses exists\n\nChanges in rubygem-activerecord-session_store_Update:\n- added CVE-2019-25025.patch (CVE-2019-25025, bsc#1183174)\n  * This requires CVE-2019-16782.patch to be included in\n    rubygem-actionpack-4_2 to work correctly.\n\n","status":"published","published":"2021-06-11T13:14:14Z","modified":"2026-02-04T02:56:38.447387Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4715-1","title":"python-django vulnerability","description":"Wang Baohua discovered that Django incorrectly extracted archive files. A\nremote attacker could possibly use this issue to extract files outside of\ntheir expected location.\n","status":"published","published":"2021-02-01T11:55:47Z","modified":"2026-02-10T04:42:02Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4715-2","title":"python-django vulnerability","description":"USN-4715-1 fixed a vulnerability in Django. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Wang Baohua discovered that Django incorrectly extracted archive files. A\n remote attacker could possibly use this issue to extract files outside of\n their expected location.\n","status":"published","published":"2021-02-01T15:53:44Z","modified":"2026-02-10T04:42:02Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}