Spoofing attack in Django - CVE-2019-3498

Vulnerability identifier: #VU16832

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3498

CWE-ID: CWE-451

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to conduct spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can craft a malicious URL that can make spoofed content appear on the default page generated by the django.views.defaults.page_not_found() view.

Django
Arch Linux
Fedora
python-django (Ubuntu package)
python-django (Debian package)
py-django (Alpine package)
python-django
python2-django1.11

The vulnerability has been addressed in the versions 1.11.18, 2.0.10, 2.1.5.

Django - addressed in versions 1.11.18, 2.0.10, 2.1.5
python-django (Debian package) - update to 1:1.10.7-2+deb9u4
py-django (Alpine package) - update to 1.11.18-r0
python-django - addressed in versions 1.11.18-1.el7, 2.0.10-1.fc28, 2.0.10-1.fc29
python2-django1.11 - update to 1.11.20-1.fc28

• https://www.djangoproject.com/weblog/2019/jan/04/security-releases/

• Spoofing attack in Django
• Debian update for python-django
• Ubuntu update for Django
• Arch Linux update for python2-django
• Arch Linux update for python-django
• Spoofing attack in py-django (Alpine package)
• Fedora 29 update for python-django
• Fedora EPEL 7 update for python-django
• Fedora 28 update for python-django
• Fedora 28 update for python2-django1.11