In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper…
Priority LOW 35CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 13 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Why it matters now
EPSS 0.03425 88th percentileScored 2026-11-07
Fix Partial Django (PyPI): 1.11.18, 2.0.10, 2.1.5Red Hat: 13 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 1.11a1 to before 1.11.18 | 1.11.18 | Patch available | GHSA-337x-4q8g-prc5 |
| — | Django (PyPI) | 2.0a1 to before 2.0.10 | 2.0.10 | Patch available | GHSA-337x-4q8g-prc5 |
| — | Django (PyPI) | 2.1a1 to before 2.1.5 | 2.1.5 | Patch available | GHSA-337x-4q8g-prc5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 1.11a1 to before 1.11.18 Fixed in 1.11.18 Patch available GHSA-337x-4q8g-prc5
- Django (PyPI) Vendor— Affected 2.0a1 to before 2.0.10 Fixed in 2.0.10 Patch available GHSA-337x-4q8g-prc5
- Django (PyPI) Vendor— Affected 2.1a1 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-337x-4q8g-prc5
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 1.11 to before 1.11.18; 2.0 to before 2.0.10; 2.1 to before 2.1.5 | Vulnerable | djangoproject |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 18.10 | Vulnerable | Canonical |
| cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* | 28 | Vulnerable | Fedoraproject |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 1.11 to before 1.11.18; 2.0 to before 2.0.10; 2.1 to before 2.1.5 Vulnerable ·djangoproject
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-337x-4q8g-prc5 Django (PyPI) Fixed in 1.11.18 Advisory →
- Fix · GHSA-337x-4q8g-prc5 Django (PyPI) Fixed in 2.0.10 Advisory →
- Fix · GHSA-337x-4q8g-prc5 Django (PyPI) Fixed in 2.1.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Certification for Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 8 (Liberty) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 8 (Liberty) Operational Tools | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 9 (Mitaka) Operational Tools | Affected | No fix yet: Fix deferred |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3498
- 2026-10-03 Alias added: GHSA-337x-4q8g-prc5
References
Patch 2
Advisory 6
Other 9
- https://groups.google.com/forum/#%21topic/django-announce/VYU7xQQTEPQ
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-17.yaml
- https://groups.google.com/forum/#!topic/django-announce/VYU7xQQTEPQ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ
- https://usn.ubuntu.com/3851-1
- https://web.archive.org/web/20200227094237/http://www.securityfocus.com/bid/106453
- https://www.djangoproject.com/weblog/2019/jan/04/security-releases
Sources
- CVE-2019-3498 · CVE Program
- CVE-2019-3498 · NVD
- FIRST EPSS
- GHSA-337x-4q8g-prc5 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-3498 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences