HTTP response splitting in Django - CVE-2021-32052

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU52942

HTTP response splitting in Django - CVE-2021-32052

Published: May 6, 2021


Vulnerability identifier: #VU52942
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-32052
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not correctly processes CRLF character sequences in URLValidator. A remote attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.

Note, the vulnerability affects Django installations on Python 3.9.5+.


Affected software

Django
Gentoo Linux
Ubuntu
Fedora
python3-django (Ubuntu package)
python-django (Ubuntu package)
python-django
dev-python/django
IBM Cloud Transformation Advisor
IBM Observability with Instana
IBM DB2
DataStage on Cloud Pak for Data

How to mitigate CVE-2021-32052

Install updates from vendor's website.

Django - addressed in versions 2.2.22, 3.1.10, 3.2.2
python3-django (Ubuntu package) - addressed in versions 1.8.71ubuntu5.15+esm5, 1:1.11.11-1ubuntu1.14, 1:1.11.11-1ubuntu1.17, 2:2.2.12-1ubuntu0.7, 2:2.2.12-1ubuntu0.11, 2:2.2.16-1ubuntu0.5, 2:2.2.20-1ubuntu0.2, 2:2.2.24-1ubuntu1.4
python-django (Ubuntu package) - addressed in versions 1.8.71ubuntu5.15+esm5, 1:1.11.11-1ubuntu1.14, 1:1.11.11-1ubuntu1.17
python-django - update to 3.1.9-1.fc34
IBM Cloud Transformation Advisor - update to 3.10.0
IBM DB2 - update to 5.0
DataStage on Cloud Pak for Data - update to 5.0.0
dev-python/django - update to 5.2.1
IBM Observability with Instana - update to 268

External References

Related Security Bulletins