CVEvulnerability
CVE-2021-44420
7.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-12-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
Affected configurations
• djangoproject django (>= 2.2 < 2.2.25)
• djangoproject django (>= 3.1 < 3.1.14)
• djangoproject django (>= 3.2 < 3.2.10)
• redhat satellite 6.0
• debian debian linux 10.0
• debian debian linux 11.0
• canonical ubuntu linux 20.04
• canonical ubuntu linux 21.04
• canonical ubuntu linux 21.10
• fedoraproject fedora 35
References
- https://docs.djangoproject.com/en/3.2/releases/security/ Patch, Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20211229-0006/ Third Party Advisory
- https://www.djangoproject.com/weblog/2021/dec/07/security-releases/ Patch, Vendor Advisory
- https://www.openwall.com/lists/oss-security/2021/12/07/1 Mailing List, Patch, Third Party Advisory
- https://docs.djangoproject.com/en/3.2/releases/security/ Patch, Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20211229-0006/ Third Party Advisory
- https://www.djangoproject.com/weblog/2021/dec/07/security-releases/ Patch, Vendor Advisory
- https://www.openwall.com/lists/oss-security/2021/12/07/1 Mailing List, Patch, Third Party Advisory