Arch Linux update for python-django

Published: 2019-01-13 12:30:11 | Updated: 2019-01-13
Severity Low
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2019-3498
CVSSv3 4.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CWE ID CWE-451
Exploitation vector Network
Public exploit N/A
Vulnerable software Arch Linux
Vulnerable software versions Arch Linux -
Vendor URL Arch Linux

Security Advisory

1) Spoofing attack

Description

The vulnerability allows a remote attacker to conduct spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can craft a malicious URL that can make spoofed content appear on the default page generated by the django.views.defaults.page_not_found() view.

Remediation

Update the affected package python-django to version 2.1.5-1.

External links

https://security.archlinux.org/advisory/ASA-201901-6

Back to List