The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. Reference: http://www.openwall.com/lists/oss-security/2019/06/03/2 https://docs.djangoproject.com/en/dev/releases/1.11.21/ https://docs.djangoproject.com/en/dev/releases/2.1.9/ https://docs.djangoproject.com/en/dev/releases/2.2.2/ https://docs.djangoproject.com/en/dev/releases/security/ https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ Upstream Patch: https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673 https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62 https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b
Created python-django tracking bugs for this issue: Affects: fedora-30 [bug 1716763]
Created python-django tracking bugs for this issue: Affects: epel-7 [bug 1716764]
External References: https://docs.djangoproject.com/en/2.1/releases/2.1.9/ https://docs.djangoproject.com/en/2.2/releases/1.11.21/ https://docs.djangoproject.com/en/2.2/releases/2.2.2/
Acknowledgments: Name: the Django project
Statement: * This issue affects the version of python-django as shipped with Red Hat Gluster Storage 3 as it contains the vulnerable code. * This issue does not affect Red Hat Satellite 6, versions 6.3, 6.4 and 6.5, because its django component only returns content-type as JSON, which does not lead to cross site scripting. * This issue does not affect Red Hat Update Infrastructure 3 because it does not use any of the Widgets provided by python-django, including AdminURLFieldWidget. * This issue does not affect redhat-certification because it does not use AdminURLFieldWidget from python-django package.
Created python-django tracking bugs for this issue: Affects: openstack-rdo [bug 1727671]