Vulnerability CVE-2021-32052

Vulnerability Name:

CVE-2021-32052 (CCN-201374)

Assigned:

2021-05-06

Published:

2021-05-06

Updated:

2022-01-01

Summary:

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.

CVSS v3 Severity:

6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

4.7 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)
4.1 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2021-32052

Source: MISC
Type: Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/06/1

Source: MISC
Type: Patch, Vendor Advisory
https://docs.djangoproject.com/en/3.2/releases/security/

Source: XF
Type: UNKNOWN
django-cve202132052-header-injection(201374)

Source: MISC
Type: Mailing List, Third Party Advisory
https://groups.google.com/forum/#!forum/django-announce

Source: FEDORA
Type: Third Party Advisory
FEDORA-2021-01044b8a59

Source: CCN
Type: oss-sec Mailing List, Thu, 6 May 2021 09:50:26 +0200
Django: CVE-2021-32052: Header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210611-0002/

Source: CCN
Type: Django Web site
Django security releases issued: 3.2.2, 3.1.10, and 2.2.22

Source: MISC
Type: Patch, Vendor Advisory
https://www.djangoproject.com/weblog/2021/may/06/security-releases/

Vulnerable Configuration:

Configuration 1:

cpe:/a:djangoproject:django:*:*:*:*:*:*:*:* (Version >= 2.2 and < 2.2.22)

OR cpe:/a:djangoproject:django:*:*:*:*:*:*:*:* (Version >= 3.1 and < 3.1.10)

OR cpe:/a:djangoproject:django:*:*:*:*:*:*:*:* (Version >= 3.2 and < 3.2.2)

AND

cpe:/a:python:python:*:*:*:*:*:*:*:* (Version >= 3.9.5

Configuration 2:

cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:113248	P	python36-Django-3.2.7-2.3 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106660	P	python36-Django-3.2.7-2.3 on GA media (Moderate)	2021-10-01

BACK