CVE-2019-12308

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2019-11358: Fixed prototype pollution.
• CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)
• CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-14232: Fixed denial-of-service possibility in django.utils.text.Truncator (bsc#1142880).
• CVE-2019-14233: Fixed denial-of-service possibility in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for JSONField/HStoreField (bsc#1142883).
• CVE-2019-14235: Fixed potential memory exhaustion in django.utils.encoding.uri_to_iri() (bsc#1142885).

Non-security issues fixed:

• Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2019-11358: Fixed prototype pollution.
• CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)
• CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-14232: Fixed denial-of-service possibility in django.utils.text.Truncator (bsc#1142880).
• CVE-2019-14233: Fixed denial-of-service possibility in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for JSONField/HStoreField (bsc#1142883).
• CVE-2019-14235: Fixed potential memory exhaustion in django.utils.encoding.uri_to_iri() (bsc#1142885).

Non-security issues fixed:

• Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.

This update was imported from the openSUSE:Leap:15.1:Update update project.

These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

This update for python-Django1 fixes the following issues:

• CVE-2019-12308: Fixed an improper validatation of the clickable 'Current URL' link in AdminURLFieldWidget which could have allowed attackers to perform XSS attacks (bsc#1136468).

This update for python-Django to version 1.11.23 fixes the following issues:

• CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).
• CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).
• CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).
• CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).

This update for python-Django1 to version 1.11.23 fixes the following issues:

• CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).
• CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).
• CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).
• CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).
• CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).

This update for python-Django fixes the following issues:

• CVE-2024-42005: Fixed SQL injection in QuerySet.values() and values_list() (bsc#1228629)
• CVE-2024-41989: Fixed Memory exhaustion in django.utils.numberformat.floatformat() (bsc#1228630)
• CVE-2024-41990: Fixed denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228631)
• CVE-2024-41991: Fixed another denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228632)
• CVE-2022-28346: Fixed SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398)
• CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)

It was discovered that Django incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10 and Ubuntu 19.04. (CVE-2019-12308)

Gavin Wahl discovered that Django incorrectly handled HTTP detection when used behind a reverse-proxy. Client requests made via HTTP would cause incorrect API results and would not be redirected to HTTPS, contrary to expectations. (CVE-2019-12781)