tocsin

PyPI/django CVE-2021-32052: unknown, EPSS 3.17%

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application

Action: Upgrade django to 2.2.22 or later.

pip install django==2.2.22
pip install django==3.1.10
pip install django==3.2.2

Affected

introducedfixedlast affected
2.22.2.22-
3.13.1.10-
3.23.2.2-

Fixed versions

2.2.223.1.103.2.2

Sources

CVE-2021-32052 · published · modified · JSON