ArchLinux: 201906-1: python2-django: cross-site scripting
Summary
The clickable "Current URL" link generated by AdminURLFieldWidget
displayed the provided value without validating it as a safe URL. Thus,
an unvalidated value stored in the database, or a value provided as a
URL query parameter payload, could result in an clickable JavaScript
link.
AdminURLFieldWidget now validates the provided value using URLValidator
before displaying the clickable link. You may customise the validator
by passing a validator_class kwarg to AdminURLFieldWidget.__init__(),
e.g. when using ModelAdmin.formfield_overrides.
Resolution
Upgrade to 1.11.21-1.
# pacman -Syu "python2-django>=1.11.21-1"
The problem has been fixed upstream in version 1.11.21.
References
https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673 https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b https://security.archlinux.org/CVE-2019-12308
Workaround
None.