Skip to content

Update django to 2.2.21#218

Closed
pyup-bot wants to merge 1 commit into
masterfrom
pyup-update-django-2.2.19-to-2.2.21
Closed

Update django to 2.2.21#218
pyup-bot wants to merge 1 commit into
masterfrom
pyup-update-django-2.2.19-to-2.2.21

Conversation

@pyup-bot
Copy link
Copy Markdown
Contributor

@pyup-bot pyup-bot commented May 4, 2021

This PR updates Django from 2.2.19 to 2.2.21.

Changelog

2.2.21

===========================

*May 4, 2021*

Django 2.2.21 fixes a security issue in 2.2.20.

CVE-2021-31542: Potential directory-traversal via uploaded files
================================================================

``MultiPartParser``, ``UploadedFile``, and ``FieldFile`` allowed
directory-traversal via uploaded files with suitably crafted file names.

In order to mitigate this risk, stricter basename and path sanitation is now
applied. Specifically, empty file names and paths with dot segments will be
rejected.


===========================

2.2.20

===========================

*April 6, 2021*

Django 2.2.20 fixes a security issue with severity "low" in 2.2.19.

CVE-2021-28658: Potential directory-traversal via uploaded files
================================================================

``MultiPartParser`` allowed directory-traversal via uploaded files with
suitably crafted file names.

Built-in upload handlers were not affected by this vulnerability.


===========================
Links

@pyup-bot pyup-bot mentioned this pull request May 4, 2021
@codecov
Copy link
Copy Markdown

codecov Bot commented May 4, 2021

Codecov Report

Merging #218 (ff58ecf) into master (a2f0d23) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #218   +/-   ##
=======================================
  Coverage   98.06%   98.06%           
=======================================
  Files          27       27           
  Lines        1293     1293           
=======================================
  Hits         1268     1268           
  Misses         25       25           

@pyup-bot
Copy link
Copy Markdown
Contributor Author

pyup-bot commented May 6, 2021

Closing this in favor of #219

@pyup-bot pyup-bot closed this May 6, 2021
@jraddaoui jraddaoui deleted the pyup-update-django-2.2.19-to-2.2.21 branch May 6, 2021 13:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant