CVE-2022-24840

Advisory

Django-s3file 5.5.1 includes a fix for CVE-2022-24840: In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the 'AWS_LOCATION' setting was set, traversal was limited to that location only. The issue was discovered by the maintainer. There were no reports of the vulnerability being known to or exploited by a third party, prior to the release of the patch.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed


* [Fix CVE-2022-24840 -- Fix Path Traversal security vulnerability](https://github.com/codingjoe/django-s3file/security/advisories/GHSA-4w8f-hjm9-xwgf)
* Add back Python 3.8 support by symroe in https://github.com/codingjoe/django-s3file/pull/215

**Full Changelog**: https://github.com/codingjoe/django-s3file/compare/5.5.0...5.5.1

Resources

• https://pypi.org/project/django-s3file
• https://pyup.io/changelogs/django-s3file/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24840
• https://github.com/codingjoe/django-s3file/commit/68ccd2c621a40eb66fdd6af2be9d5fcc9c373318
• https://github.com/codingjoe/django-s3file/security/advisories/GHSA-4w8f-hjm9-xwgf