In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Dec 7, 2021 |
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-localeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-netrcUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-typesUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foremanUpgrade satellite-cloneUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-runtimeUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-unfUpgrade rubygem-unicodeUpgrade rubygem-loggingUpgrade satellite-cliUpgrade tfm-rubygem-jwtUpgrade rubygem-domain_nameUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-clampUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-highlineUpgrade rubygem-hammer_cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-rest-clientUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-brandingUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade satelliteUpgrade tfm-rubygem-multi_jsonUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade foreman-cliUpgrade rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-oauthUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-highlineUpgrade rubygem-powerbarUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdisk | Jul 14, 2022 | Dec 8, 2021 |
| Debian | — | Upgrade python-django | Jul 30, 2024 | Dec 8, 2021 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Oracle Solaris | — | Upgrade library/python/django-39 to version 3.2.10-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/python/django to version 3.2.10-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/python/django-37 to version 2.2.25-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Dec 8, 2021 |
| Oracle_linux | — | Upgrade ol-automation-manager-cliUpgrade ol-automation-managerUpgrade python3-olamkit | Apr 28, 2022 | Dec 8, 2021 |
| Redhat_linux | — | Upgrade rubygem-http-cookieUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cliUpgrade tfm-runtimeUpgrade rubygem-oauthUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-netrcUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade rubygem-rest-clientUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-mime-typesUpgrade tfm-rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-amazing_printUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-powerbarUpgrade tfm-rubygem-mime-typesUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade foreman-cliUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cliUpgrade rubygem-loggingUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hashieUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-rest-clientUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-debugsourceUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-unfUpgrade tfm-rubygem-clampUpgrade rubygem-highlineUpgrade satelliteUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-brandingUpgrade satellite-maintainUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-clampUpgrade rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_azure_rm | Jul 14, 2022 | Dec 8, 2021 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfo | Mar 12, 2024 | Dec 8, 2021 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Dec 8, 2021 |
| Ubuntu | — | Upgrade python3-django | Mar 22, 2023 | Dec 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub