Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-44420

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

Published

2021-12-08T00:15:07.757

Last Modified

2024-11-21T06:30:56.037

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.3 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	djangoproject	django	< 2.2.25	Yes
Application	djangoproject	django	< 3.1.14	Yes
Application	djangoproject	django	< 3.2.10	Yes
Operating System	redhat	satellite	6.0	Yes
Operating System	debian	debian_linux	10.0	Yes
Operating System	debian	debian_linux	11.0	Yes
Operating System	canonical	ubuntu_linux	20.04	Yes
Operating System	canonical	ubuntu_linux	21.04	Yes
Operating System	canonical	ubuntu_linux	21.10	Yes
Operating System	fedoraproject	fedora	35	Yes

References

https://docs.djangoproject.com/en/3.2/releases/security/ Patch, Vendor Advisory ([email protected])
https://groups.google.com/forum/#%21forum/django-announce ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ ([email protected])
https://security.netapp.com/advisory/ntap-20211229-0006/ Third Party Advisory ([email protected])
https://www.djangoproject.com/weblog/2021/dec/07/security-releases/ Patch, Vendor Advisory ([email protected])
https://www.openwall.com/lists/oss-security/2021/12/07/1 Mailing List, Patch, Third Party Advisory ([email protected])
https://docs.djangoproject.com/en/3.2/releases/security/ Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://groups.google.com/forum/#%21forum/django-announce (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20211229-0006/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.djangoproject.com/weblog/2021/dec/07/security-releases/ Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.openwall.com/lists/oss-security/2021/12/07/1 Mailing List, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)