Security: Django vulnerabilities found in requirements/extras.txt

[yaselc]

CVE-2021-3281
moderate severity
Vulnerable versions: >= 3.0, < 3.1.6
Patched version: 3.1.6
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

---

CVE-2020-24583
high severity
Vulnerable versions: >= 3.0, < 3.0.10
Patched version: 3.0.10
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.

---

CVE-2020-24584
high severity
Vulnerable versions: >= 3.0, < 3.0.10
Patched version: 3.0.10
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.