CVE-2021-44420: High severity django vulnerability
HTTP requests for URLs with trailing newlines could bypass an upstream access control based on URL paths.
Other sources
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-44420?
The severity of CVE-2021-44420 is medium, with a severity value of 5.3.
How can HTTP requests with trailing newlines bypass access control in Django versions affected by CVE-2021-44420?
HTTP requests with trailing newlines can bypass access control in Django versions affected by CVE-2021-44420 by exploiting a vulnerability in how URLs with trailing newlines are handled.
Which versions of Django are affected by CVE-2021-44420?
Django versions 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10 are affected by CVE-2021-44420.
How do I fix CVE-2021-44420 in Django?
To fix CVE-2021-44420 in Django, you should update to version 2.2.25, 3.1.14, or 3.2.10, depending on the version you are currently using.
Where can I find more information about CVE-2021-44420?
You can find more information about CVE-2021-44420 on the CVE website, the NIST NVD website, the Django security releases blog post, the Red Hat Bugzilla page, and the Red Hat access portal.