In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Dec 7, 2021 |
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-oauthUpgrade satellite-cliUpgrade tfm-rubygem-unfUpgrade rubygem-unicodeUpgrade rubygem-mime-typesUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-loggingUpgrade rubygem-domain_nameUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-little-pluggerUpgrade tfm-runtimeUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-mime-types-dataUpgrade rubygem-netrcUpgrade rubygem-localeUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-rest-clientUpgrade satellite-maintainUpgrade satellite-brandingUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-display_widthUpgrade foreman-cliUpgrade satelliteUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-unf_extUpgrade tfm-rubygem-netrcUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-http-cookieUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansible | Jul 14, 2022 | Dec 8, 2021 |
| Debian | — | Upgrade python-django | Jul 30, 2024 | Dec 8, 2021 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Oracle Solaris | — | Upgrade library/python/django-37 to version 2.2.25-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/python/django to version 3.2.10-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/python/django-39 to version 3.2.10-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Dec 8, 2021 |
| Oracle_linux | — | Upgrade ol-automation-manager-cliUpgrade python3-olamkitUpgrade ol-automation-manager | Apr 28, 2022 | Dec 8, 2021 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-unfUpgrade tfm-rubygem-unf_extUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-foreman_maintainUpgrade rubygem-jwtUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-highlineUpgrade tfm-rubygem-localeUpgrade rubygem-unf_ext-debugsourceUpgrade satelliteUpgrade tfm-rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-multi_jsonUpgrade satellite-brandingUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicodeUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-powerbarUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-jwtUpgrade rubygem-http-cookieUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-amazing_printUpgrade rubygem-loggingUpgrade satellite-cliUpgrade rubygem-hashieUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-loggingUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-oauthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hashieUpgrade satellite-cloneUpgrade tfm-runtimeUpgrade rubygem-unf_extUpgrade rubygem-localeUpgrade rubygem-multi_jsonUpgrade rubygem-oauthUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-rest-client | Jul 14, 2022 | Dec 8, 2021 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfo | Mar 12, 2024 | Dec 8, 2021 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Dec 8, 2021 |
| Ubuntu | — | Upgrade python3-django | Mar 22, 2023 | Dec 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub