In accordance with our security release policy, the Django team is issuing Django 1.11.15 and Django 2.0.8. These release addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2018-14574: Open redirect possibility in CommonMiddleware

If the django.middleware.common.CommonMiddleware and the APPEND_SLASH setting are both enabled, and if the project has a URL pattern that accepts any path ending in a slash (many content management systems have such a pattern), then a request to a maliciously crafted URL of that site could lead to a redirect to another site, enabling phishing and other attacks.

Thanks Andreas Hug for reporting this issue.

Affected supported versions Django master branch

Django 2.1 (which will be released in a separate blog post later today)

Django 2.0

Django 1.11 Per our supported versions policy, Django 1.10 and older are no longer supported.