{"id":"CVE-2021-44420","published":"2021-12-07T22:55:40Z","modified":"2024-08-04T04:17:25Z","title":"In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02421,"percentile":0.84133,"provenance":"source"},"cwes":[],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":["x_refsource_MISC"]},{"url":"https://docs.djangoproject.com/en/3.2/releases/security/","tags":["x_refsource_MISC"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/07/1","tags":["x_refsource_CONFIRM"]},{"url":"https://www.djangoproject.com/weblog/2021/dec/07/security-releases/","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20211229-0006/","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":16.8,"factors":[{"name":"EPSS percentile","points":16.83}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=2.2a1, <2.2.25",">=3.0a1, <3.1.14",">=3.2a1, <3.2.10",">=2.2, <2.2.25",">=3.1, <3.1.14",">=3.2, <3.2.10"],"patched":["2.2.25","3.1.14","3.2.10"],"from":["GHSA-v6rh-hp5x-86rv","PYSEC-2021-439"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0062","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2018-14574","parents":[{"from":"CVE-2018-14574","to":"CVE-2021-44420","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/urls/resolvers.py"],"commits":["https://github.com/django/django/commit/6fffc3c6d420e44f4029d5643f38d00a39b08525","https://github.com/django/django/commit/c4e5ff7fdb5fce447675e90291fd33fddd052b3c","https://github.com/django/django/commit/d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2021-44420","to":"CVE-2022-41323","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/urls/resolvers.py"],"commits":["https://github.com/django/django/commit/d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6","https://github.com/django/django/commit/5b6b257fa7ec37ff27965358800c67e2dd11c924","https://github.com/django/django/commit/23f0093125ac2e553da6c1b2f9988eb6a3dd2ea1"],"basis":"shared function","functions":["__init__"]}]}],"packageHistory":[{"cve":"CVE-2021-33203","published":"2021-06-08","fixed":"3.2.4","kev":false,"link":{"from":"CVE-2021-33203","to":"CVE-2021-44420","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"2.2.24","toFixed":"2.2.25","daysApart":182}]}},{"cve":"CVE-2021-33571","published":"2021-06-08","fixed":"3.2.4","kev":false},{"cve":"CVE-2021-35042","published":"2021-07-02","fixed":"3.2.5","kev":false,"link":{"from":"CVE-2021-35042","to":"CVE-2021-44420","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.1.13","toFixed":"3.1.14","daysApart":158}]}},{"cve":"CVE-2021-44420","published":"2021-12-07","fixed":"3.2.10","kev":false},{"cve":"CVE-2021-45115","published":"2022-01-04","fixed":"4.0.1","kev":false},{"cve":"CVE-2021-45116","published":"2022-01-04","fixed":"4.0.1","kev":false},{"cve":"CVE-2021-45452","published":"2022-01-04","fixed":"4.0.1","kev":false}],"package":"PyPI:Django"}}