innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

[2.2.x] Added CVE-2021-45115, CVE-2021-45116, and CVE-2021-45452 to security archive. 

Backport of 63869ab1f1 from main
This commit is contained in:
Carlton Gibson 2022-01-04 11:30:11 +01:00
parent e085d46e4b
commit 77d0fe5868
1 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
docs/releases/security.txt
View File

@ -1244,3 +1244,45 @@ Versions affected
* Django 3.2 :commit:`(patch) <333c65603032c377e682cdbd7388657a5463a05a>`
* Django 3.1 :commit:`(patch) <22bd17488159601bf0741b70ae7932bffea8eced>`
* Django 2.2 :commit:`(patch) <7cf7d74e8a754446eeb85cacf2fef1247e0cb6d7>`
January 4, 2022 - :cve:`2021-45115`
------------------------------------
Denial-of-service possibility in ``UserAttributeSimilarityValidator``. `Full
description
<https://www.djangoproject.com/weblog/2022/jan/04/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
* Django 4.0 :commit:`(patch) <df79ef03ac867c93caaa6be56bc69e66abfeef8f>`
* Django 3.2 :commit:`(patch) <a8b32fe13bcaed1c0b772fdc53de84abc224fb20>`
* Django 2.2 :commit:`(patch) <2135637fdd5ce994de110affef9e67dffdf77277>`
January 4, 2022 - :cve:`2021-45116`
------------------------------------
Potential information disclosure in ``dictsort`` template filter. `Full
description
<https://www.djangoproject.com/weblog/2022/jan/04/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
* Django 4.0 :commit:`(patch) <2a8ec7f546d6d5806e221ec948c5146b55bd7489>`
* Django 3.2 :commit:`(patch) <c7fe895bca06daf12cc1670b56eaf72a1ef27a16>`
* Django 2.2 :commit:`(patch) <c9f648ccfac5ab90fb2829a66da4f77e68c7f93a>`
January 4, 2022 - :cve:`2021-45452`
------------------------------------
Potential directory-traversal via ``Storage.save()``. `Full description
<https://www.djangoproject.com/weblog/2022/jan/04/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
* Django 4.0 :commit:`(patch) <e1592e0f26302e79856cc7f2218ae848ae19b0f6>`
* Django 3.2 :commit:`(patch) <8d2f7cff76200cbd2337b2cf1707e383eb1fb54b>`
* Django 2.2 :commit:`(patch) <4cb35b384ceef52123fc66411a73c36a706825e1>`