| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 2.2, < 2.2.24≥ 2.2a1, < 2.2.24≥ 3.0, < 3.1.12≥ 3.0a1, < 3.1.12≥ 3.2, < 3.2.4≥ 3.2a1, < 3.2.4 | 2.2.243.1.123.2.4 |
| django | ≥ 2.2, < 2.2.24≥ 3.0, < 3.1.12≥ 3.2, < 3.2.4 | 2.2.243.1.123.2.4 |
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free