PT-2019-20171 · Django Software Foundation · Django

Published 2019-06-03 · Updated 2019-06-03

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Django versions 1.11 before 1.11.21 Django versions 2.1 before 2.1.9 Django versions 2.2 before 2.2.2

Description An issue was discovered where the clickable Current URL value displayed by the AdminURLFieldWidget does not validate the provided value as a safe URL. This could result in an unvalidated value stored in the database, or a value provided as a URL query parameter payload, leading to a clickable JavaScript link.

Recommendations For Django versions 1.11 before 1.11.21, update to version 1.11.21 or later. For Django versions 2.1 before 2.1.9, update to version 2.1.9 or later. For Django versions 2.2 before 2.2.2, update to version 2.2.2 or later.

Related Identifiers

PYSEC-2019-9

Affected Products

Django

References · 18

• https://debian.org/security/2019/dsa-4476 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-9 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html · Note
• https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html · Note
• https://seclists.org/bugtraq/2019/Jul/10 · Note
• http://securityfocus.com/bid/108559 · Note
• https://djangoproject.com/weblog/2019/jun/03/security-releases · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html · Note
• https://usn.ubuntu.com/4043-1 · Note
• https://docs.djangoproject.com/en/dev/releases/2.2.2 · Note
• https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8 · Note
• http://openwall.com/lists/oss-security/2019/06/03/2 · Note
• https://docs.djangoproject.com/en/dev/releases/2.1.9 · Note
• https://docs.djangoproject.com/en/dev/releases/1.11.21 · Note