PT-2021-19642 · Django+3 · Django+3
Mariusz Felisiak
·
Published
2021-05-06
·
Updated
2026-01-03
·
CVE-2021-32052
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Django versions 2.2 before 2.2.22
Django versions 3.1 before 3.1.10
Django versions 3.2 before 3.2.2
Description:
The issue arises from the URLValidator in Django not prohibiting newlines and tabs, unless the URLField form field is used. This can lead to header injection if an application uses values with newlines in an HTTP response. However, Django itself is not affected because HttpResponse prohibits newlines in HTTP headers.
Recommendations:
For Django versions 2.2 before 2.2.22, update to version 2.2.22 or later to resolve the issue.
For Django versions 3.1 before 3.1.10, update to version 3.1.10 or later to resolve the issue.
For Django versions 3.2 before 3.2.2, update to version 3.2.2 or later to resolve the issue.
As a temporary workaround, consider restricting the use of values with newlines in HTTP responses to minimize the risk of header injection.
Fix
Argument Injection
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Django
Linuxmint
Ubuntu