In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Dec 7, 2021 |
| Centos_linux | — | Upgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-domain_nameUpgrade tfm-rubygem-localeUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-runtimeUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-domain_nameUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-loggingUpgrade tfm-rubygem-oauthUpgrade satellite-cliUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-loggingUpgrade rubygem-mime-typesUpgrade rubygem-localeUpgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-types-dataUpgrade rubygem-netrcUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-clampUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-oauthUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-clampUpgrade rubygem-hashieUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-rest-clientUpgrade satellite-brandingUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade tfm-rubygem-hashieUpgrade rubygem-rest-clientUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-multi_jsonUpgrade satelliteUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unfUpgrade rubygem-fast_gettextUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsource | Jul 14, 2022 | Dec 8, 2021 |
| Debian | — | Upgrade python-django | Jul 30, 2024 | Dec 8, 2021 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Oracle Solaris | — | Upgrade library/python/django to version 3.2.10-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/python/django-37 to version 2.2.25-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/python/django-39 to version 3.2.10-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Dec 8, 2021 |
| Oracle_linux | — | Upgrade ol-automation-managerUpgrade python3-olamkitUpgrade ol-automation-manager-cli | Apr 28, 2022 | Dec 8, 2021 |
| Redhat_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade tfm-runtimeUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade foreman-cliUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-netrcUpgrade rubygem-rest-clientUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-powerbarUpgrade rubygem-localeUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hashieUpgrade rubygem-loggingUpgrade rubygem-http-cookieUpgrade tfm-rubygem-highlineUpgrade satellite-cliUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-typesUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hashieUpgrade rubygem-domain_nameUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-unicodeUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-unf_extUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-jwtUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade satelliteUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-clampUpgrade satellite-brandingUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-domain_nameUpgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade tfm-rubygem-rest-clientUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli | Jul 14, 2022 | Dec 8, 2021 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfo | Mar 12, 2024 | Dec 8, 2021 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Dec 8, 2021 |
| Ubuntu | — | Upgrade python3-django | Mar 22, 2023 | Dec 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub