Skip to content
OpenAdvisories
High DSA-4476-1 3 CVEs

python-django - security update

Published Jul 5, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 python-django 1:1.10.7-2+deb9u5

Vulnerabilities 3

  • High 7.5
    CVE-2019-6975

    Uncontrolled Memory Consumption in Django

    Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 6.1
    CVE-2019-12308

    Django Cross-site Scripting in AdminURLFieldWidget

    An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value sto…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.3
    CVE-2019-12781

    Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS

    An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. …

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI