CVE-2018-25045

Advisory

Django-user-management 18.0.0 updates its dependency 'djangorestframework' to a version >=3.9.1 to patch an XSS vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* BREAKING: Add a app_name to each of the urls entry points. See the docs/views.md for updated default url namespaces.
* Fix Pillow security issue
* Drop support for Python < 3.6
* Add support for Python 3.6, 3.7 and 3.8
* Drop support for Django < 1.11
* Add Django 2.2 and 3.0 to travis
* Update djangorestframework>=3.9.1 for XSS fix https://github.com/encode/django-rest-framework/commit/75a489150ae24c2f3c794104a8e98fa43e2c9ce9
* Update incuna_mail>=4.1.0 for Django 3 support

Resources

• https://pypi.org/project/django-user-management
• https://pyup.io/changelogs/django-user-management/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25045