(Snyk)(LOW) Cross-site Scripting (XSS) due 9/3/19

[fec-jli]

Summary

During Snyk scanning. found one low vulnerability in requirements.txt.
Cross-site Scripting (XSS) Vulnerable module: django
Introduced through: django-libsass@0.7, django-jinja@2.4.1 and others

detail https://app.snyk.io/vuln/SNYK-PYTHON-DJANGO-174885

To do

• Upgrade django to version 1.11.21, 2.1.9, 2.2.2 or higher.

[jason-upchurch]

Issue dependent on solution to: #3023 (solution to related issue will resolve this issue).

[jason-upchurch]

Upgrade to django@1.11.22 introduces 4 new medium severity vulnerabilities:

✗ Medium severity vulnerability found in django
  Description: Denial of Service (Memory Exhaustion)
  Info: https://snyk.io/vuln/SNYK-PYTHON-DJANGO-456540
  Introduced through: django@1.11.22, cg-django-uaa@1.3.0, django-jinja@2.4.1, django-libsass@0.7
  From: django@1.11.22
  From: cg-django-uaa@1.3.0 > django@1.11.22
  From: django-jinja@2.4.1 > django@1.11.22

✗ Medium severity vulnerability found in django
  Description: Denial of Service (DoS)
  Info: https://snyk.io/vuln/SNYK-PYTHON-DJANGO-456541
  Introduced through: django@1.11.22, cg-django-uaa@1.3.0, django-jinja@2.4.1, django-libsass@0.7
  From: django@1.11.22
  From: cg-django-uaa@1.3.0 > django@1.11.22
  From: django-jinja@2.4.1 > django@1.11.22
  and 1 more...

✗ Medium severity vulnerability found in django
  Description: Denial of Service (DoS)
  Info: https://snyk.io/vuln/SNYK-PYTHON-DJANGO-456542
  Introduced through: django@1.11.22, cg-django-uaa@1.3.0, django-jinja@2.4.1, django-libsass@0.7
  From: django@1.11.22
  From: cg-django-uaa@1.3.0 > django@1.11.22
  From: django-jinja@2.4.1 > django@1.11.22

✗ Medium severity vulnerability found in django
  Description: SQL Injection
  Info: https://snyk.io/vuln/SNYK-PYTHON-DJANGO-456566
  Introduced through: django@1.11.22, cg-django-uaa@1.3.0, django-jinja@2.4.1, django-libsass@0.7
  From: django@1.11.22
  From: cg-django-uaa@1.3.0 > django@1.11.22
  From: django-jinja@2.4.1 > django@1.11.22

Will upgrade to django@1.11.23. This issue is resolved by #3092

[patphongs]

Upgrade to django@1.11.23 has been merged in, closing...