Django security releases issued: 2.2.2, 2.1.9 and 1.11.21

In accordance with our security release policy, the Django team is issuing Django 1.11.21, Django 2.1.9, and Django 2.2.2. These releases addresses the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2019-12308: AdminURLFieldWidget XSS The clickable "Current URL" link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. AdminURLFieldWidget now validates the provided value using URLValidator before displaying the clickable link. You may customise the validator by passing a validator_class kwarg to AdminURLFieldWidget.__init__() , e.g. when using ModelAdmin.formfield_overrides . Affected versions Django master development branch

Django 2.2 before version 2.2.2

Django 2.1 before version 2.1.9

Django 1.11 before version 1.11.21

Patched bundled jQuery for CVE-2019-11358: Prototype pollution jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype . The bundled version of jQuery used by the Django admin has been patched to allow for the select2 library's use of jQuery.extend() . Affected versions Django master development branch

Django 2.2 before version 2.2.2

Django 2.1 before version 2.1.9