This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2019-3498 →
DEBIAN-CVE-2019-3498
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downs...
Original description
The description as published by the source.
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
python-django
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.18-1"}]}]
Debian:13
python-django
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.18-1"}]}]
Debian:14
python-django
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.18-1"}]}]
References
- advisory security-tracker.debian.org