{"title":"Django 2.2.24 release notes","version":"dev","locale":"en","docname":"releases/2.2.24","url":"/en/dev/releases/2.2.24/","canonical":"https://djangodocs.dev/en/dev/releases/2.2.24/","summary":"Django 2.2.24 fixes two security issues in 2.2.23. Staff members could use the admindocs TemplateDetailView view to check the existence of arbitrary files.","html":"<h1>Django 2.2.24 release notes<a class=\"heading-anchor\" href=\"#django-2-2-24-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>June 2, 2021</em></p>\n<p>Django 2.2.24 fixes two security issues in 2.2.23.</p>\n<section id=\"cve-2021-33203-potential-directory-traversal-via-admindocs\">\n<h2>CVE-2021-33203: Potential directory traversal via <code class=\"docutils literal notranslate\">admindocs</code><a class=\"heading-anchor\" href=\"#cve-2021-33203-potential-directory-traversal-via-admindocs\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Staff members could use the <a class=\"reference internal\" href=\"/en/dev/ref/contrib/admin/admindocs/#module-django.contrib.admindocs\" title=\"django.contrib.admindocs: Django's admin documentation generator.\"><code class=\"xref py py-mod docutils literal notranslate\">admindocs</code></a>\n<code class=\"docutils literal notranslate\">TemplateDetailView</code> view to check the existence of arbitrary files.\nAdditionally, if (and only if) the default admindocs templates have been\ncustomized by the developers to also expose the file contents, then not only\nthe existence but also the file contents would have been exposed.</p>\n<p>As a mitigation, path sanitation is now applied and only files within the\ntemplate root directories can be loaded.</p>\n</section>\n<section id=\"cve-2021-33571-possible-indeterminate-ssrf-rfi-and-lfi-attacks-since-validators-accepted-leading-zeros-in-ipv4-addresses\">\n<h2>CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses<a class=\"heading-anchor\" href=\"#cve-2021-33571-possible-indeterminate-ssrf-rfi-and-lfi-attacks-since-validators-accepted-leading-zeros-in-ipv4-addresses\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.URLValidator\" title=\"django.core.validators.URLValidator\"><code class=\"xref py py-class docutils literal notranslate\">URLValidator</code></a>,\n<a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.validate_ipv4_address\" title=\"django.core.validators.validate_ipv4_address\"><code class=\"xref py py-func docutils literal notranslate\">validate_ipv4_address()</code></a>, and\n<a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.validate_ipv46_address\" title=\"django.core.validators.validate_ipv46_address\"><code class=\"xref py py-func docutils literal notranslate\">validate_ipv46_address()</code></a> didn’t prohibit leading\nzeros in octal literals. If you used such values you could suffer from\nindeterminate SSRF, RFI, and LFI attacks.</p>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.validate_ipv4_address\" title=\"django.core.validators.validate_ipv4_address\"><code class=\"xref py py-func docutils literal notranslate\">validate_ipv4_address()</code></a> and\n<a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.validate_ipv46_address\" title=\"django.core.validators.validate_ipv46_address\"><code class=\"xref py py-func docutils literal notranslate\">validate_ipv46_address()</code></a> validators were not\naffected on Python 3.9.5+.</p>\n</section>","rootId":"django-2-2-24-release-notes","toc":[{"title":"CVE-2021-33203: Potential directory traversal via admindocs","anchor":"cve-2021-33203-potential-directory-traversal-via-admindocs","children":[]},{"title":"CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses","anchor":"cve-2021-33571-possible-indeterminate-ssrf-rfi-and-lfi-attacks-since-validators-accepted-leading-zeros-in-ipv4-addresses","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/2.2.25","title":"Django 2.2.25 release notes","url":"/en/dev/releases/2.2.25/"},"next":{"docname":"releases/2.2.23","title":"Django 2.2.23 release notes","url":"/en/dev/releases/2.2.23/"},"formats":{"html":"/en/dev/releases/2.2.24/","markdown":"/en/dev/releases/2.2.24.md","json":"/en/dev/releases/2.2.24.json"},"source":"https://github.com/django/django/blob/main/docs/releases/2.2.24.txt","official":"https://docs.djangoproject.com/en/dev/releases/2.2.24/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","2.2"],"inLocales":["en"]}