In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization
    of Special Elements in Output Used by a Downstream Component issue exists in
    django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails
    to recognize that a crafted URL has malicious content. (CVE-2019-3498)

- CVE-2019-3498: Content spoofing possibility in the     default 404 page

  - CVE-2019-6975: Memory exhaustion in     django.utils.numberformat.format()

  - Fixed a race condition in QuerySet.update_or_create()     that could result in data loss

  - geo: Prevented repetitive calls to geos_version_tuple()     in the WKBWriter class

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fix CVE-2019-3498 python-django: Content spoofing via URL path in

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3851-1 advisory.

    It was discovered that Django incorrectly handled the default 404 page. A remote attacker could use this     issue to spoof content using a malicious URL.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that malformed URLs could spoof the content of the default 404 page of Django, a Python web development framework.

Django security releases issued reports :

An attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the django.views.defaults.page_not_found() view.

It was discovered that there was a content-spoofing vulnerability in the default 404 pages in the Django web development framework.

For more information, please see :

https://www.djangoproject.com/weblog/2019/jan/04/security-releases/

For Debian 8 'Jessie', this issue has been fixed in python-django version 1.7.11-1+deb8u4.

We recommend that you upgrade your python-django packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
426227	Alpine: multiple py3-django packages: security update to 1.11.18-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426227	Alpine: multiple py3-django packages: security update to 1.11.18-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
422505	SCA: security update for Django (GHSA-337x-4q8g-prc5)	Tenable Cloud Security	SCA Checks	high
422505	SCA: security update for Django (GHSA-337x-4q8g-prc5)	Tenable Self-Hosted Container Security	SCA Checks	high
406642	Alpine: multiple py3-django packages: security update to 1.11.18-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406642	Alpine: multiple py3-django packages: security update to 1.11.18-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
406603	Alpine: py-django: security update to 1.11.18-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406603	Alpine: py-django: security update to 1.11.18-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400571	Alpine: Django: security update to 1.11.15-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400571	Alpine: Django: security update to 1.11.15-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
122980	Fedora 28 : python2-django1.11 (2019-5ad2149e99)	Nessus	Fedora Local Security Checks	medium
121196	Fedora 28 : python-django (2019-e6ca5847c7)	Nessus	Fedora Local Security Checks	medium
121082	Fedora 29 : python-django (2019-a7b53ed5a3)	Nessus	Fedora Local Security Checks	medium
121063	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Django vulnerability (USN-3851-1)	Nessus	Ubuntu Local Security Checks	medium
121056	Debian DSA-4363-1 : python-django - security update	Nessus	Debian Local Security Checks	medium
120968	FreeBSD : Django -- Content spoofing possibility in the default 404 page (3e41c1a6-10bc-11e9-bd85-fcaa147e860e)	Nessus	FreeBSD Local Security Checks	medium
120962	Debian DLA-1629-1 : python-django security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-3498

high

Tenable Plugins

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium