Medium USN-4742-1 1 CVE

python-django vulnerability

Published Feb 22, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Django incorrectly accepted semicolons as query
parameters. A remote attacker could possibly use this issue to perform a
Web Cache Poisoning attack.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	python-django	1:1.11.11-1ubuntu1.11
Ubuntu · 20.04 LTS 20.04:LTS	python-django	2:2.2.12-1ubuntu0.4

Vulnerabilities 1

Medium 5.9

CVE-2021-23336 EPSS 41%

Web Cache Poisoning

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…

python-django python-django python3.4 python3.5 Debian Ubuntu Azure Linux Alpine

Feb 15, 2021

References

report
https://ubuntu.com/security/CVE-2021-23336