1. ============================

  2. Django 1.11.18 release notes

  3. ============================

  4. 

  5. *January 4, 2019*

  6. 

  7. Django 1.11.18 fixes a security issue in 1.11.17.

  8. 

  9. CVE-2019-3498: Content spoofing possibility in the default 404 page

  10. -------------------------------------------------------------------

  11. 

  12. An attacker could craft a malicious URL that could make spoofed content appear

  13. on the default page generated by the ``django.views.defaults.page_not_found()``

  14. view.

  15. 

  16. The URL path is no longer displayed in the default 404 template and the

  17. ``request_path`` context variable is now quoted to fix the issue for custom

  18. templates that use the path.
About Sign Up Leave Feedback Contact