Summary
Sjoerd Job Postmus and TengMA discovered that Django incorrectly handled
URLs with trailing newlines. A remote attacker could possibly use this
issue to bypass certain access controls.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | python-django | 2:2.2.12-1ubuntu0.8 |
Vulnerabilities 1
-
High 7.3
Potential bypass of an upstream access control based on URL paths in Django
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
References
-
report
https://ubuntu.com/security/CVE-2021-44420