GitLab

If the django.middleware.common.CommonMiddleware and the APPEND_SLASH setting are both enabled, and if the project
has a URL pattern that accepts any path ending in a slash (many content management systems have such a pattern), then a request to
a maliciously crafted URL of that site could lead to a redirect to another site, enabling phishing and other attacks.

Fixed In Version:

Django 1.11.15 and Django 2.0.8

References:

https://www.djangoproject.com/weblog/2018/aug/01/security-releases/
http://openwall.com/lists/oss-security/2018/08/01/2

Patch:

https://github.com/django/django/commit/d6eaee092709aad477a9894598496c6deec532ff

(from redmine: issue id 9173, created on 2018-08-02)

• Relations:
  • copied_to #9174 (closed)
  • copied_to #9175 (closed)
  • copied_to #9176 (closed)
  • copied_to #9177 (closed)
  • copied_to #9178 (closed)
  • child #9174 (closed)
  • child #9175 (closed)
  • child #9176 (closed)
  • child #9177 (closed)
  • child #9178 (closed)