CVE-2021-44420
published 2021-12-08CVE-2021-44420: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based…
PriorityP345high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
2.30%
81.1th percentile
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | python-django | < python-django 2:3.2.10-1 (bookworm) | python-django 2:3.2.10-1 (bookworm) |
| djangoproject | django | >= 2.2 < 2.2.25 | 2.2.25 |
| djangoproject | django | >= 2.2a1 < 2.2.25 | 2.2.25 |
| djangoproject | django | >= 3.0a1 < 3.1.14 | 3.1.14 |
| djangoproject | django | >= 3.1 < 3.1.14 | 3.1.14 |
| djangoproject | django | >= 3.2 < 3.2.10 | 3.2.10 |
| djangoproject | django | >= 3.2a1 < 3.2.10 | 3.2.10 |
| fedoraproject | fedora | — | — |
| redhat | satellite | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.3HIGH
vendor_debian7.3HIGH
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Potential bypass of an upstream access control based on URL paths in Django
osv·2021-12-09
CVE-2021-44420 [MEDIUM] Potential bypass of an upstream access control based on URL paths in Django
Potential bypass of an upstream access control based on URL paths in Django
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. This issue has low severity, according to the Django security policy.
GHSA
Potential bypass of an upstream access control based on URL paths in Django
ghsa·2021-12-09
CVE-2021-44420 [MEDIUM] CWE-287 Potential bypass of an upstream access control based on URL paths in Django
Potential bypass of an upstream access control based on URL paths in Django
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. This issue has low severity, according to the Django security policy.
OSV
CVE-2021-44420: In Django 2
osv·2021-12-08·CVSS 7.3
CVE-2021-44420 [HIGH] CVE-2021-44420: In Django 2
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
Red Hat
django: potential bypass of an upstream access control based on URL paths
vendor_redhat·2021-12-07·CVSS 7.3
CVE-2021-44420 [HIGH] CWE-290 django: potential bypass of an upstream access control based on URL paths
django: potential bypass of an upstream access control based on URL paths
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
Package: python-django (Red Hat Ansible Automation Platform 1.2) - Affected
Package: python-django (Red Hat Ansible Automation Platform 2) - Affected
Package: django (Red Hat Ansible Tower 3) - Affected
Package: calamari-server (Red Hat Ceph Storage 2) - Out of support scope
Package: python-django (Red Hat Ceph Storage 2) - Out of support scope
Package: python-django (Red Hat Ceph Storage 3) - Out of support scope
Package: python-django (Red Hat OpenStack Platform 10 (Newton)) - Out of support scope
Package: python-django (Red Hat OpenSt
Ubuntu
Django vulnerability
vendor_ubuntu·2021-12-07
CVE-2021-44420 Django vulnerability
Title: Django vulnerability
Summary: Django could be made to expose sensitive information.
Sjoerd Job Postmus and TengMA discovered that Django incorrectly handled
URLs with trailing newlines. A remote attacker could possibly use this
issue to bypass certain access controls.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2021-44420: python-django - In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requ...
vendor_debian·2021·CVSS 7.3
CVE-2021-44420 [HIGH] CVE-2021-44420: python-django - In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requ...
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
Scope: local
bookworm: resolved (fixed in 2:3.2.10-1)
bullseye: resolved (fixed in 2:2.2.25-1~deb11u1)
forky: resolved (fixed in 2:3.2.10-1)
sid: resolved (fixed in 2:3.2.10-1)
trixie: resolved (fixed in 2:3.2.10-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.djangoproject.com/en/3.2/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20211229-0006/https://www.djangoproject.com/weblog/2021/dec/07/security-releases/https://www.openwall.com/lists/oss-security/2021/12/07/1https://docs.djangoproject.com/en/3.2/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20211229-0006/https://www.djangoproject.com/weblog/2021/dec/07/security-releases/https://www.openwall.com/lists/oss-security/2021/12/07/1
2021-12-08
Published