GoogleOSV:GHSA-QM57-VHQ3-3FWFHeader injection possible in Django
EPSS
Percentile
53.5%
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
References
www.openwall.com/lists/oss-security/2021/05/06/1
bugzilla.redhat.com/show_bug.cgi?id=1944801
docs.djangoproject.com/en/3.2/releases/security
github.com/django/django/commit/e1e81aa1c4427411e3c68facdd761229ffea6f6f
groups.google.com/forum/#!forum/django-announce
lists.fedoraproject.org/archives/list/[email protected]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE
nvd.nist.gov/vuln/detail/CVE-2021-32052
security.netapp.com/advisory/ntap-20210611-0002
www.djangoproject.com/weblog/2021/may/06/security-releases
Related
