Read the docs
TI-2021-20035 Aliases CVE-2021-44420GHSA-v6rh-hp5x-86rv

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for…

Priority LOW 37CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 2 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

Why it matters now

EPSS 0.02421 84th percentileScored 2026-11-07
Fix Partial Django (PyPI): 2.2.25, 3.1.14, 3.2.10Red Hat: 2 advisoriesRed Hat: 2 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Django (PyPI)2.2a1 to before 2.2.252.2.25Patch availableGHSA-v6rh-hp5x-86rv
—Django (PyPI)3.0a1 to before 3.1.143.1.14Patch availableGHSA-v6rh-hp5x-86rv
—Django (PyPI)3.2a1 to before 3.2.103.2.10Patch availableGHSA-v6rh-hp5x-86rv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Django (PyPI) Vendor— Affected 2.2a1 to before 2.2.25 Fixed in 2.2.25 Patch available GHSA-v6rh-hp5x-86rv
  • Django (PyPI) Vendor— Affected 3.0a1 to before 3.1.14 Fixed in 3.1.14 Patch available GHSA-v6rh-hp5x-86rv
  • Django (PyPI) Vendor— Affected 3.2a1 to before 3.2.10 Fixed in 3.2.10 Patch available GHSA-v6rh-hp5x-86rv

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*2.2 to before 2.2.25; 3.1 to before 3.1.14; 3.2 to before 3.2.10Vulnerabledjangoproject
cpe:2.3:o:redhat:satellite:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*21.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*21.10VulnerableCanonical
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 2.2 to before 2.2.25; 3.1 to before 3.1.14; 3.2 to before 3.2.10 Vulnerable ·djangoproject
  • cpe:2.3:o:redhat:satellite:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:* Versions 21.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:* Versions 21.10 Vulnerable ·Canonical
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-v6rh-hp5x-86rv Django (PyPI) Fixed in 2.2.25 Advisory →
  • Fix · GHSA-v6rh-hp5x-86rv Django (PyPI) Fixed in 3.1.14 Advisory →
  • Fix · GHSA-v6rh-hp5x-86rv Django (PyPI) Fixed in 3.2.10 Advisory →

Red Hat 2 advisories

  • RHSA-2023:0742 Released 2023-02-13 · Red Hat rating Low
    RHUI 4.3.0 release - Security Fixes, Bug Fixes, and Enhancements Update
    • RHUI 4 for RHEL 8 python-django-3.2.16-1.0.1.el8ui, python39-django-3.2.16-1.0.1.el8ui
  • RHSA-2022:5498 Released 2022-07-05 · Red Hat rating Moderate
    Satellite 6.11 Release
    • Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
    • Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 1.2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ansible Tower 3AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Satellite 6AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet: Fix deferred
RHUI 4 for RHEL 8Fixed RHSA-2023:0742
Red Hat Satellite 6.11 for RHEL 8Fixed RHSA-2022:5498
Not affected: 5 products
  • RHUI 4 for RHEL 8
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Satellite 6.11 for RHEL 7
  • Red Hat Satellite 6.11 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44420
  2. 2026-10-03 Alias added: GHSA-v6rh-hp5x-86rv

References

Patch 3

Advisory 4

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences