CVE-2019-3498: canonical ubuntu_linux
Vulnerability summary
CVE-2019-3498 is a medium (CVSS 6.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 3.43% chance of exploitation in the next 30 days, higher than 88.9% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 10Timeline
- 09-01-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
3.43%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine2 products
- py-django< 1.11.18-r0
- py3-django< 1.11.18-r0
Debian2 products
- python-django< 1:1.11.18-1 | < 1:1.10.7-2+deb9u4 | < 1.7.11-1+deb8u4
- debian_linuxEOL8.0 | 9.0
Mageia2 products
- python-django< 1.8.19-1.1.mga6
- python-django16< 1.6.11.6-1.1.mga6
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Djangoproject1 product
- django≥ 1.11, < 1.11.18 | ≥ 2.0, < 2.0.10 | ≥ 2.1, < 2.1.5
Fedoraproject1 product
- fedoraEOL28
PyPI1 product
- django≥ 1.11a1, < 1.11.18 | ≥ 2.0a1, < 2.0.10 | ≥ 2.1a1, < 2.1.5 | ≥ 2.1, < 2.1.5
Suse1 product
- python-Django&distro=SUSE OpenStack Cloud 7< 1.8.19-3.9.1
Ubuntu1 product
- python-django< 1.6.11-0ubuntu1.3 | < 1.8.7-1ubuntu5.7 | < 1:1.11.11-1ubuntu1.2
9 vendors · 12 products
References
31 links- groups.google.com/forum/X Refsource MISC
lists.debian.org/debian-lts-announce/2019/01/msg00005.htmlMailing ListX Refsource MLISTWEBThird Party Advisory- www.djangoproject.com/weblog/2019/jan/04/security-releases/X Refsource MISCWEBARTICLEREPORTPatchVendor Advisory
- www.debian.org/security/2019/dsa-4363Vendor AdvisoryX Refsource DEBIANWEBAdvisoryThird Party Advisory
Show all 31 references
- github.com/django/djangoPACKAGE