CVE-2019-12308
2 advisories.
PyPI/django CVE-2019-12308: medium 6.1
Django Cross-site Scripting in AdminURLFieldWidget
Action: Upgrade django to 1.11.21 or later.
pip install django==1.11.21pip install django==2.1.9pip install django==2.2.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.11a1 | 1.11.21 | - |
| 2.1a1 | 2.1.9 | - |
| 2.2a1 | 2.2.2 | - |
Fixed versions
| 1.11.21 | 2.1.9 | 2.2.2 |
Sources
- osv: GHSA-7rp2-fm2h-wchj
- https://nvd.nist.gov/vuln/detail/CVE-2019-12308
- https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62
- https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673
- https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b
- https://www.djangoproject.com/weblog/2019/jun/03/security-releases
- https://www.debian.org/security/2019/dsa-4476
- https://usn.ubuntu.com/4043-1
- https://security.gentoo.org/glsa/202004-17
- https://seclists.org/bugtraq/2019/Jul/10
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G
- https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html
- https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html
- https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yaml
- https://github.com/django/django
- https://github.com/advisories/GHSA-7rp2-fm2h-wchj
- https://docs.djangoproject.com/en/dev/releases/security
- https://docs.djangoproject.com/en/dev/releases/2.2.2
- https://docs.djangoproject.com/en/dev/releases/2.1.9
- https://docs.djangoproject.com/en/dev/releases/1.11.21
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
- http://www.openwall.com/lists/oss-security/2019/06/03/2
CVE-2019-12308 · published · modified · JSON
PyPI/django CVE-2019-12308: unknown
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without
Action: Upgrade django to 1.11.21 or later.
pip install django==2.1.9pip install django==1.11.21pip install django==2.2.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.11 | 1.11.21 | - |
| 2.1 | 2.1.9 | - |
| 2.2 | 2.2.2 | - |
Fixed versions
| 2.1.9 | 1.11.21 | 2.2.2 |
Sources
- osv: PYSEC-2019-79
- https://www.djangoproject.com/weblog/2019/jun/03/security-releases/
- https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8
- https://docs.djangoproject.com/en/dev/releases/security/
- https://docs.djangoproject.com/en/dev/releases/2.2.2/
- https://docs.djangoproject.com/en/dev/releases/2.1.9/
- https://docs.djangoproject.com/en/dev/releases/1.11.21/
- http://www.openwall.com/lists/oss-security/2019/06/03/2
- http://www.securityfocus.com/bid/108559
- https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/
- https://usn.ubuntu.com/4043-1/
- https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html
- https://www.debian.org/security/2019/dsa-4476
- https://seclists.org/bugtraq/2019/Jul/10
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
- https://security.gentoo.org/glsa/202004-17
- https://github.com/advisories/GHSA-7rp2-fm2h-wchj
CVE-2019-12308 · published · modified · JSON