[ASA-201906-2] python-django: cross-site scripting

[Jelle van der Waa]

Arch Linux Security Advisory ASA-201906-2
=========================================

Severity: Medium
Date    : 2019-06-04
CVE-ID  : CVE-2019-11358 CVE-2019-12308
Package : python-django
Type    : cross-site scripting
Remote  : Yes
Link    : https://security.archlinux.org/AVG-969

Summary
=======

The package python-django before version 2.2.2-1 is vulnerable to
cross-site scripting.

Resolution
==========

Upgrade to 2.2.2-1.

# pacman -Syu "python-django>=2.2.2-1"

The problems have been fixed upstream in version 2.2.2.

Workaround
==========

None.

Description
===========

- CVE-2019-11358 (cross-site scripting)

jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of
Object.prototype pollution. If an unsanitized source object contained
an enumerable __proto__ property, it could extend the native
Object.prototype.

The bundled version of jQuery used by the Django admin has been patched
to allow for the select2 library's use of jQuery.extend().

- CVE-2019-12308 (cross-site scripting)

The clickable "Current URL" link generated by AdminURLFieldWidget
displayed the provided value without validating it as a safe URL. Thus,
an unvalidated value stored in the database, or a value provided as a
URL query parameter payload, could result in an clickable JavaScript
link.

AdminURLFieldWidget now validates the provided value using URLValidator
before displaying the clickable link. You may customise the validator
by passing a validator_class kwarg to AdminURLFieldWidget.__init__(),
e.g. when using ModelAdmin.formfield_overrides.

Impact
======

A remote attacker is able to execute javascript and create html content
in the admin view or by extending the native Object.prototype via
jQuery.extend.

References
==========

https://www.djangoproject.com/weblog/2019/jun/03/security-releases/
https://github.com/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee6e6ad
https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673
https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b
https://security.archlinux.org/CVE-2019-11358
https://security.archlinux.org/CVE-2019-12308
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20190604/13df71e8/attachment.sig>