CVE-2019-12308

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

============================

*June 3, 2019*

Django 1.11.21 fixes a security issue in 1.11.20.

CVE-2019-12308: AdminURLFieldWidget XSS
---------------------------------------

The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed
the provided value without validating it as a safe URL. Thus, an unvalidated
value stored in the database, or a value provided as a URL query parameter
payload, could result in an clickable JavaScript link.

``AdminURLFieldWidget`` now validates the provided value using
:class:`~django.core.validators.URLValidator` before displaying the clickable
link. You may customise the validator by passing a ``validator_class`` kwarg to
``AdminURLFieldWidget.__init__()``, e.g. when using
:attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.


============================

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12308
• https://www.djangoproject.com/weblog/2019/jun/03/security-releases/
• https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8
• https://docs.djangoproject.com/en/dev/releases/security/
• https://docs.djangoproject.com/en/dev/releases/2.2.2/
• https://docs.djangoproject.com/en/dev/releases/2.1.9/
• https://docs.djangoproject.com/en/dev/releases/1.11.21/
• http://www.openwall.com/lists/oss-security/2019/06/03/2
• http://www.securityfocus.com/bid/108559
• https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html
• https://lists.fedoraproject.org/archives/list/[email protected]/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/
• https://usn.ubuntu.com/4043-1/
• https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html
• https://www.debian.org/security/2019/dsa-4476
• https://seclists.org/bugtraq/2019/Jul/10
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
• https://security.gentoo.org/glsa/202004-17