Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2019-3498 →
DEBIAN-CVE-2019-3498
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downs...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
python-django
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.18-1"}]}]
Debian:13
python-django
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.18-1"}]}]
Debian:14
python-django
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.18-1"}]}]
Références
- advisory security-tracker.debian.org