tocsin

PyPI/django CVE-2021-44420: unknown, EPSS 2.42%

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

Action: Upgrade django to 2.2.25 or later.

pip install django==2.2.25
pip install django==3.1.14
pip install django==3.2.10

Affected

introducedfixedlast affected
2.22.2.25-
3.13.1.14-
3.23.2.10-

Fixed versions

2.2.253.1.143.2.10

Sources

CVE-2021-44420 · published · modified · JSON