CVE-2021-44420
Fixed in a distro release EPSS 2%
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
Products: djangoproject django, redhat satellite, debian_linux, canonical ubuntu_linux, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 2.2.25 |
| PyPI | django | 3.1.14 |
| PyPI | django | 3.2.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | python-django | 3.2.10-1 |
| Debian 12 | python-django | 2:3.2.10-1 |
| Debian 13 | python-django | 2:3.2.10-1 |
| Debian 14 | python-django | 2:3.2.10-1 |
| Red Hat rhui 4 | python-django | 0:3.2.16-1.0.1.el8ui |
| Red Hat rhui 4 | python39-django | 0:3.2.16-1.0.1.el8ui |
| Red Hat satellite 6.11 | candlepin | 0:4.1.13-1.el7sat |
| Red Hat satellite 6.11 | candlepin | 0:4.1.13-1.el8sat |
| Red Hat satellite 6.11 | foreman | 0:3.1.1.21-2.el7sat |
| Red Hat satellite 6.11 | foreman | 0:3.1.1.21-2.el8sat |
| Red Hat satellite 6.11 | libsolv | 0:0.7.22-1.el7pc |
| Red Hat satellite 6.11 | libsolv | 0:0.7.22-1.el8pc |
| Red Hat satellite 6.11 | python-django | 0:3.2.13-1.el8pc |
| Red Hat satellite 6.11 | python-lxml | 0:4.7.1-1.el8pc |
| Red Hat satellite 6.11 | python-sqlparse | 0:0.4.2-2.el8pc |
| Red Hat satellite 6.11 | python38-django | 0:3.2.13-1.el8pc |
| Red Hat satellite 6.11 | rubygem-actionpack | 0:6.0.4.7-1.el8sat |
| Red Hat satellite 6.11 | rubygem-puma | 0:5.6.2-1.el8sat |
| Red Hat satellite 6.11 | rubygem-puma-debuginfo | 0:5.6.2-1.el8sat |
| Red Hat satellite 6.11 | rubygem-puma-debugsource | 0:5.6.2-1.el8sat |
| Red Hat satellite 6.11 | rubygem-sidekiq | 0:5.2.10-1.el8sat |
| Red Hat satellite 6.11 | satellite | 0:6.11.0-2.el7sat |
| Red Hat satellite 6.11 | satellite | 0:6.11.0-2.el8sat |
| Red Hat satellite 6.11 | tfm-rubygem-actionpack | 0:6.0.4.7-1.el7sat |
| Red Hat satellite 6.11 | tfm-rubygem-puma | 0:5.6.2-1.el7sat |
| Red Hat satellite 6.11 | tfm-rubygem-puma-debuginfo | 0:5.6.2-1.el7sat |
| Red Hat satellite 6.11 | tfm-rubygem-sidekiq | 0:5.2.10-1.el7sat |
| Red Hat satellite capsule 6.11 | foreman | 0:3.1.1.21-2.el7sat |
| Red Hat satellite capsule 6.11 | foreman | 0:3.1.1.21-2.el8sat |
| Red Hat satellite capsule 6.11 | libsolv | 0:0.7.22-1.el7pc |
| Red Hat satellite capsule 6.11 | libsolv | 0:0.7.22-1.el8pc |
| Red Hat satellite capsule 6.11 | python-django | 0:3.2.13-1.el8pc |
| Red Hat satellite capsule 6.11 | python-lxml | 0:4.7.1-1.el8pc |
| Red Hat satellite capsule 6.11 | python-sqlparse | 0:0.4.2-2.el8pc |
| Red Hat satellite capsule 6.11 | python38-django | 0:3.2.13-1.el8pc |
| Red Hat satellite capsule 6.11 | satellite | 0:6.11.0-2.el7sat |
| Red Hat satellite capsule 6.11 | satellite | 0:6.11.0-2.el8sat |
| Red Hat satellite utils 6.11 | foreman | 0:3.1.1.21-2.el8sat |
| Red Hat satellite utils 6.11 | foreman | 0:3.1.1.21-2.el7sat |
| Red Hat satellite utils 6.11 | satellite | 0:6.11.0-2.el7sat |
| Red Hat satellite utils 6.11 | satellite | 0:6.11.0-2.el8sat |
| Rocky Linux 8 | libdb | 0:5.3.28-42.el8_4 |
| SUSE Package Hub 15 SP3 | python-Django | 2.2.28-bp153.2.3.1 |
| Ubuntu 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.8 |
| openSUSE Leap 15.3 | python-Django | 2.2.28-bp153.2.3.1 |
| openSUSE Tumbleweed | python-sentry-sdk | 2.20.0-1.1 |
| openSUSE Tumbleweed | python-sentry-sdk | 1.5.4-1.1 |