[Snyk:Medium] Access Restriction Bypass (due by 03/08/2022)

[pkfec]

Overview

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Access Restriction Bypass. HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

https://security.snyk.io/vuln/SNYK-PYTHON-DJANGO-2312875

Introduced through:

project@0.0.0 › django@3.1.13
Fix: Upgrade django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › cg-django-uaa@2.1.1 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › django-jinja@2.7.0 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › django-storages@1.7.1 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › wagtail@2.11.8 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › wagtail@2.11.8 › django-filter@2.4.0 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › wagtail@2.11.8 › django-taggit@1.5.1 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › wagtail@2.11.8 › django-treebeard@4.5.1 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › wagtail@2.11.8 › djangorestframework@3.13.0 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10
Introduced through: project@0.0.0 › django-libsass@0.7 › django-compressor@3.0 › django-appconf@1.0.5 › django@3.1.13
Fix: Pin django to version 2.2.25 or 3.1.14 or 3.2.10

Remediation:

Upgrade django to version 2.2.25 or 3.1.14 or 3.2.10

Completion criteria:

• Upgrade django to version 3.1.14
• Make a followup ticket to 3.2.10

[patphongs]

This vulnerability will require us to upgrade Django to 3.2.11. We'll use that ticket as the follow-up to upgrade.