search

civictechdc / ancfinder

A website about DC's Advisory Neighborhood Commission system.
http://ancfinder.org/
Creative Commons Zero v1.0 Universal
43 stars 36 forks source link

1 django vulnerability found in requirements.txt #175

Closed rbmy closed 5 years ago

rbmy commented 5 years ago

CVE-2019-3498 More information

low severity Vulnerable versions: >= 2.1.0, < 2.1.5 Patched version: 2.1.5 In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

rbmy commented 5 years ago

remedy is to update the requirements to have

django>=2.1.5

allowing it to use a version that does not have the above vulnerability.

rbmy commented 5 years ago

fixed in #178