FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Django -- possible XSS in traceback section of technical 500 debug page

Affected packages
	py27-django110	<	1.10.8
	py34-django110	<	1.10.8
	py35-django110	<	1.10.8
	py36-django110	<	1.10.8
	py27-django111	<	1.11.5
	py34-django111	<	1.11.5
	py35-django111	<	1.11.5
	py36-django111	<	1.11.5

Details

VuXML ID	aaab03be-932d-11e7-92d8-4b26fc968492
Discovery	2017-09-05
Entry	2017-09-06

Django blog:

In older versions, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.

[source]

References

CVE Name	CVE-2017-12794
URL	https://www.djangoproject.com/weblog/2017/sep/05/security-releases/