FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Django -- possible XSS in traceback section of technical 500 debug page

Affected packages
py27-django110 < 1.10.8
py34-django110 < 1.10.8
py35-django110 < 1.10.8
py36-django110 < 1.10.8
py27-django111 < 1.11.5
py34-django111 < 1.11.5
py35-django111 < 1.11.5
py36-django111 < 1.11.5

Details

VuXML ID aaab03be-932d-11e7-92d8-4b26fc968492
Discovery 2017-09-05
Entry 2017-09-06

Django blog:

In older versions, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.

References

CVE Name CVE-2017-12794
URL https://www.djangoproject.com/weblog/2017/sep/05/security-releases/