PyPI/django CVE-2019-19118: medium 6.5, EPSS 1.67%

Django allows unintended model editing

Action: Upgrade django to 2.1.15 or later.

pip install django==2.1.15

pip install django==2.2.8

Affected

Fixed versions

Sources

• osv: GHSA-hvmf-r92r-27hr
• https://nvd.nist.gov/vuln/detail/CVE-2019-19118
• https://github.com/django/django/commit/103ebe2b5ff1b2614b85a52c239f471904d26244
• https://github.com/django/django/commit/36f580a17f0b3cb087deadf3b65eea024f479c21
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/advisories/GHSA-hvmf-r92r-27hr
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-15.yaml
• https://groups.google.com/forum/#!topic/django-announce/GjGqDvtNmWQ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5
• https://security.gentoo.org/glsa/202004-17
• https://security.netapp.com/advisory/ntap-20191217-0003
• https://www.djangoproject.com/weblog/2019/dec/02/security-releases
• http://www.openwall.com/lists/oss-security/2019/12/02/1

CVE-2019-19118 · published 2019-12-04T21:26:28Z · modified 2024-11-19T05:33:19.050183Z · JSON