CVE-2019-3498: Improper Input Validation in Django
(updated )
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
References
- docs.djangoproject.com/en/dev/releases/security
- github.com/advisories/GHSA-337x-4q8g-prc5
- github.com/django/django
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-17.yaml
- groups.google.com/forum/
- lists.debian.org/debian-lts-announce/2019/01/msg00005.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ
- nvd.nist.gov/vuln/detail/CVE-2019-3498
- usn.ubuntu.com/3851-1
- web.archive.org/web/20200227094237/http://www.securityfocus.com/bid/106453
- www.debian.org/security/2019/dsa-4363
- www.djangoproject.com/weblog/2019/jan/04/security-releases
Code Behaviors & Features
Detect and mitigate CVE-2019-3498 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →