—

PYSEC-2017-44

Quick fix

PYSEC-2017-44 — django: upgrade to the fixed version with the command below.

pip install --upgrade 'django>=1.10.8'

Details

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django

Introduced in: 1.10Fixed in: 1.10.8

Fixpip install --upgrade 'django>=1.10.8'

References

https://www.djangoproject.com/weblog/2017/sep/05/security-releases/[ARTICLE]
http://www.securitytracker.com/id/1039264[WEB]
http://www.securityfocus.com/bid/100643[WEB]
https://usn.ubuntu.com/3559-1/[WEB]
https://github.com/advisories/GHSA-9r8w-6x8c-6jr9[ADVISORY]