PT-2019-20171 · Django Software Foundation · Django

Publicado 2019-06-03 · Atualizado 2019-06-03

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Django versions 1.11 before 1.11.21 Django versions 2.1 before 2.1.9 Django versions 2.2 before 2.2.2

Description An issue was discovered where the clickable Current URL value displayed by the AdminURLFieldWidget does not validate the provided value as a safe URL. This could result in an unvalidated value stored in the database, or a value provided as a URL query parameter payload, leading to a clickable JavaScript link.

Recommendations For Django versions 1.11 before 1.11.21, update to version 1.11.21 or later. For Django versions 2.1 before 2.1.9, update to version 2.1.9 or later. For Django versions 2.2 before 2.2.2, update to version 2.2.2 or later.

Identificadores relacionados

PYSEC-2019-9

Produtos afetados

Django

Referências · 18

• https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html · Nota
• https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html · Nota
• https://seclists.org/bugtraq/2019/Jul/10 · Nota
• https://debian.org/security/2019/dsa-4476 · Aviso do Fabricante
• http://securityfocus.com/bid/108559 · Nota
• https://djangoproject.com/weblog/2019/jun/03/security-releases · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html · Nota
• https://usn.ubuntu.com/4043-1 · Nota
• https://docs.djangoproject.com/en/dev/releases/2.2.2 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-9 · Aviso do Fabricante
• https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8 · Nota
• http://openwall.com/lists/oss-security/2019/06/03/2 · Nota
• https://docs.djangoproject.com/en/dev/releases/2.1.9 · Nota
• https://docs.djangoproject.com/en/dev/releases/1.11.21 · Nota