PT-2019-20168 · Django Software Foundation · Django

Publicado 2019-01-09 · Atualizado 2019-01-09

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Django versions 1.11.x through 1.11.17 Django versions 2.0.x through 2.0.9 Django versions 2.1.x through 2.1.4

Description The issue exists in the django.views.defaults.page not found() function, leading to content spoofing in a 404 error page if a user fails to recognize that a crafted URL has malicious content. This occurs due to improper neutralization of special elements in output used by a downstream component.

Recommendations For Django versions 1.11.x through 1.11.17, update to version 1.11.18 or later. For Django versions 2.0.x through 2.0.9, update to version 2.0.10 or later. For Django versions 2.1.x through 2.1.4, update to version 2.1.5 or later.

Identificadores relacionados

PYSEC-2019-87

Produtos afetados

Django

Referências · 9

• http://securityfocus.com/bid/106453 · Nota
• https://groups.google.com/forum/#!topic/django-announce/VYU7xQQTEPQ · Nota
• https://debian.org/security/2019/dsa-4363 · Aviso do Fabricante
• https://djangoproject.com/weblog/2019/jan/04/security-releases · Nota
• https://docs.djangoproject.com/en/dev/releases/security · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ · Aviso do Fabricante
• https://usn.ubuntu.com/3851-1 · Nota
• https://lists.debian.org/debian-lts-announce/2019/01/msg00005.html · Nota
• https://osv.dev/vulnerability/PYSEC-2019-87 · Aviso do Fabricante