From 6e58828f8bcd33dfc91f236a972ae5fd23c9b0bc Mon Sep 17 00:00:00 2001
From: Carlton Gibson <carlton.gibson@noumenal.es>
Date: Fri, 19 Feb 2021 11:07:56 +0100
Subject: [PATCH] [2.2.x] Added CVE-2021-23336 to security archive.

Backport of ab58f072502e86dfe21b2bd5cccdc5e94dce8d26 from master
---
 docs/releases/security.txt | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/docs/releases/security.txt b/docs/releases/security.txt
index e82c4be41e..10f871d563 100644
--- a/docs/releases/security.txt
+++ b/docs/releases/security.txt
@@ -1147,3 +1147,18 @@ Versions affected
 * Django 3.1 :commit:`(patch) <02e6592835b4559909aa3aaaf67988fef435f624>`
 * Django 3.0 :commit:`(patch) <52e409ed17287e9aabda847b6afe58be2fa9f86a>`
 * Django 2.2 :commit:`(patch) <21e7622dec1f8612c85c2fc37fe8efbfd3311e37>`
+
+February 19, 2021 - :cve:`2021-23336`
+-------------------------------------
+
+Web cache poisoning via ``django.utils.http.limited_parse_qsl()``. `Full
+description
+<https://www.djangoproject.com/weblog/2021/feb/19/security-releases/>`__
+
+Versions affected
+~~~~~~~~~~~~~~~~~
+
+* Django 3.2 :commit:`(patch) <be8237c7cce24b06aabde0b97afce98ddabbe3b6>`
+* Django 3.1 :commit:`(patch) <8f6d431b08cbb418d9144b976e7b972546607851>`
+* Django 3.0 :commit:`(patch) <326a926beef869d3341bc9ef737887f0449b6b71>`
+* Django 2.2 :commit:`(patch) <fd6b6afd5959b638c62dbf4839ccff97e7f7dfda>`