CVE-2019-3498: Input Validation
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Other sources
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 2.1.5 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 2.0.10 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 1.11.18 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.1.5 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.0.10 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.11.18 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.28-1~deb11u2Fixed in 2:2.2.28-1~deb11u12Fixed in 3:3.2.19-1+deb12u1Fixed in 3:3.2.25-0+deb12u1Fixed in 3:4.2.23-1Fixed in 3:4.2.27-0+deb13u1Fixed in 3:4.2.28-1 - Upgrade
Upgrade
alpine/py-djangoto a version that resolves this vulnerability.Fixed in 1.11.18-r0 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 1.11.18-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 1.11.18 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 2.0.10 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 2.1.5
Event History
Frequently Asked Questions
What is CVE-2019-3498?
CVE-2019-3498 is a vulnerability in Django versions 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5 that allows for content spoofing in a 404 error page.
How severe is CVE-2019-3498?
CVE-2019-3498 has a severity rating of 6.5 (medium).
Which versions of Django are affected by CVE-2019-3498?
Django versions 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5 are affected.
How can I fix CVE-2019-3498?
To fix CVE-2019-3498, update Django to version 2.1.5 (for 2.1.x), 2.0.10 (for 2.0.x), or 1.11.18 (for 1.11.x).
Where can I find more information about CVE-2019-3498?
You can find more information about CVE-2019-3498 at the following sources: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-3498), [Django releases](https://docs.djangoproject.com/en/dev/releases/security/), and [GitHub advisory](https://github.com/advisories/GHSA-337x-4q8g-prc5).