6.1
CVSSv3

CVE-2021-32052

Published: 06/05/2021 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

In Django 2.2 prior to 2.2.22, 3.1 prior to 3.1.10, and 3.2 prior to 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

djangoproject django

fedoraproject fedora 34

Vendor Advisories

Debian Bug report logs - #988136 python-django: CVE-2021-32052 Package: python-django; Maintainer for python-django is Debian Python Team <team+python@trackerdebianorg>; Source for python-django is src:python-django (PTS, buildd, popcon) Reported by: "Chris Lamb" <lamby@debianorg> Date: Thu, 6 May 2021 12:03:01 U ...
Several security issues were fixed in Django ...
Several security issues were fixed in Django ...
A flaw was found in django On Python 395+, `URLValidator` didn't prohibited newlines and tabs which could lead to a header injection attack if these were used in an HTTP response The highest threat from this vulnerability is to data confidentiality and integrity ...
On Python 395+, URLValidator didn't prohibit newlines and tabs If you used values with newlines in HTTP response, you could suffer from header injection attacks Django itself wasn't vulnerable because HttpResponse prohibits newlines in HTTP headers Moreover, the URLField form field which uses URLValidator silently removes newlines and tabs on ...