Vulnerability advisory

PYSEC-2019-17

Published Jan 9, 2019Updated Nov 8, 2023OSV record ↗

Also known as CVE-2019-3498GHSA-337x-4q8g-prc5

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`1.11` to before 1.11.18	`1.11.18`Advisories →
`2.0` to before 2.0.10	`2.0.10`Advisories →
`2.1` to before 2.1.5	`2.1.5`Advisories →
Also listed as affected (33) `1.11` `1.11.1` `1.11.2` `1.11.3` `1.11.4` `1.11.5` `1.11.6` `1.11.7` `1.11.8` `1.11.9` `1.11.10` `1.11.11` `1.11.12` `1.11.13` `1.11.14` `1.11.15` `1.11.16` `1.11.17` `2.0` `2.0.1` `2.0.2` `2.0.3` `2.0.4` `2.0.5` `2.0.6` `2.0.7` `2.0.8` `2.0.9` `2.1` `2.1.1` `2.1.2` `2.1.3` `2.1.4`

Description

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

PYSEC-2019-17

Affected versions

django PyPI

Description

References