~ / search / GHSA-337x-4q8g-prc5

GHSA-337x-4q8g-prc5

Improper Input Validation in Django

Source: GitHub Advisory Database (reviewed) High CVE-2019-3498

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 1.11a1, < 1.11.18 1.11.18
PyPI Django >= 2.0a1, < 2.0.10 2.0.10
PyPI Django >= 2.1a1, < 2.1.5 2.1.5

Details

As written in the advisory (Markdown source, shown as plain text).

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in `django.views.defaults.page_not_found()`, leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

References

External links from the advisory. They lead to third-party sites.