CVE-2021-44420

Advisory

Django versions 2.2.25, 3.1.14 and 3.2.10 include a fix for CVE-2021-44420: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
https://www.djangoproject.com/weblog/2021/dec/07/security-releases/

Affected package

Affected versions

Fixed versions

Vulnerability changelog

===========================

*December 7, 2021*

Django 2.2.25 fixes a security issue with severity "low" in 2.2.24.

CVE-2021-44420: Potential bypass of an upstream access control based on URL paths
=================================================================================

HTTP requests for URLs with trailing newlines could bypass an upstream access
control based on URL paths.


===========================

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44420
• https://docs.djangoproject.com/en/3.2/releases/security/
• https://www.openwall.com/lists/oss-security/2021/12/07/1
• https://www.djangoproject.com/weblog/2021/dec/07/security-releases/
• https://groups.google.com/forum/#!forum/django-announce
• https://security.netapp.com/advisory/ntap-20211229-0006/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/