CVE-2019-11358

Advisory

Django versions 2.1.9 and 2.2.2 include a patched bundled jQuery version to avoid a Prototype Pollution vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

==========================*June 3, 2019*Django 2.2.2 fixes security issues and several bugs in 2.2.1.CVE-2019-12308: AdminURLFieldWidget XSS---------------------------------------The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayedthe provided value without validating it as a safe URL. Thus, an unvalidatedvalue stored in the database, or a value provided as a URL query parameterpayload, could result in an clickable JavaScript link.``AdminURLFieldWidget`` now validates the provided value using:class:`~django.core.validators.URLValidator` before displaying the clickablelink. You may customise the validator by passing a ``validator_class`` kwarg to``AdminURLFieldWidget.__init__()``, e.g. when using:attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.Patched bundled jQuery for CVE-2019-11358: Prototype pollution--------------------------------------------------------------jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of``Object.prototype`` pollution. If an unsanitized source object contained anenumerable ``__proto__`` property, it could extend the native``Object.prototype``.The bundled version of jQuery used by the Django admin has been patched toallow for the ``select2`` library's use of ``jQuery.extend()``.Bugfixes========* Fixed a regression in Django 2.2 that stopped Show/Hide toggles working on dynamically added admin inlines (:ticket:`30459`).* Fixed a regression in Django 2.2 where deprecation message crashes if ``Meta.ordering`` contains an expression (:ticket:`30463`).* Fixed a regression in Django 2.2.1 where :class:`~django.contrib.postgres.search.SearchVector` generates SQL with a redundant ``Coalesce`` call (:ticket:`30488`).* Fixed a regression in Django 2.2 where auto-reloader doesn't detect changes in ``manage.py`` file when using ``StatReloader`` (:ticket:`30479`).* Fixed crash of :class:`~django.contrib.postgres.aggregates.ArrayAgg` and :class:`~django.contrib.postgres.aggregates.StringAgg` with ``ordering`` argument when used in a ``Subquery`` (:ticket:`30315`).* Fixed a regression in Django 2.2 that caused a crash of auto-reloader when an exception with custom signature is raised (:ticket:`30516`).* Fixed a regression in Django 2.2.1 where auto-reloader unnecessarily reloads translation files multiple times when using ``StatReloader`` (:ticket:`30523`).==========================

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358