Django security releases issued: 2.2.2, 2.1.9 and 1.11.21

In accordance with our security release policy, the Django team is issuing Django 1.11.21, Django 2.1.9, and Django 2.2.2. These releases addresses the security issues detailed below.

We encourage all users of Django to upgrade as soon as possible.

CVE-2019-12308: AdminURLFieldWidget XSS

The clickable “Current URL” link generated by AdminURLFieldWidget displayed
the provided value without validating it as a safe URL. Thus, an unvalidated
value stored in the database, or a value provided as a URL query parameter
payload, could result in an clickable JavaScript link.

AdminURLFieldWidget now validates the provided value using URLValidator
before displaying the clickable link. You may customise the validator by
passing a validator_class kwarg to AdminURLFieldWidget.__init__(), e.g.
when using ModelAdmin.formfield_overrides.

Affected versions

  • Django master development branch
  • Django 2.2 before version 2.2.2
  • Django 2.1 before version 2.1.9
  • Django 1.11 before version 1.11.21

Patched bundled jQuery for CVE-2019-11358: Prototype pollution

jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of
Object.prototype pollution. If an unsanitized source object contained an
enumerable __proto__ property, it could extend the native
Object.prototype.

The bundled version of jQuery used by the Django admin has been patched to
allow for the select2 library’s use of jQuery.extend().

Affected versions

  • Django master development branch
  • Django 2.2 before version 2.2.2
  • Django 2.1 before version 2.1.9

Resolution

Patches to resolve these issues have been applied to Django’s master branch and
the 2.2, 2.1, and 1.11 release branches. The patches may be obtained from the
following changesets:

On the master branch:

On the 2.2 release branch:

On the 2.1 release branch:

On the 1.11 release branch:

The following releases have been issued:

The PGP key ID used for these releases is Carlton Gibson: E17DF5C82B4F9D00.

General notes regarding security reporting

As always, we ask that potential security issues be reported via
private email to security@djangoproject.com, and not via Django’s
Trac instance or the django-developers list. Please see our security
policies
for further
information.

Original Source

Leave a comment