innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

[2.0.x] Used extlinks for GitHub commits. 

Backport of c34c6d0a2f from master.
This commit is contained in:
Tim Graham 2019-02-01 15:42:48 -05:00
parent ab5fc25635
commit c89ab95a36
3 changed files with 172 additions and 173 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/conf.py
View File

@ -44,6 +44,7 @@ extensions = [
]
extlinks = {
'commit': ('https://github.com/django/django/commit/%s', ''),
'cve': ('https://nvd.nist.gov/view/vuln/detail?vulnId=%s', 'CVE-'),
'ticket': ('https://code.djangoproject.com/ticket/%s', '#'),
}

4
docs/internals/howto-release-django.txt
View File

@ -180,9 +180,7 @@ OK, this is the fun part, where we actually push out a release!
checkout security/1.5.x; git rebase stable/1.5.x``) and then switch back and
do the merge. Make sure the commit message for each security fix explains
that the commit is a security fix and that an announcement will follow
(`example security commit`__).
__ https://github.com/django/django/commit/3ef4bbf495cc6c061789132e3d50a8231a89406b
(:commit:`example security commit <bf39978a53f117ca02e9a0c78b76664a41a54745>`).
#. For a feature release, remove the ``UNDER DEVELOPMENT`` header at the
top of the release notes and add the release date on the next line. For a

340
docs/releases/security.txt
View File

@ -46,9 +46,9 @@ Filename validation issue in translation framework. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 0.90 `(patch) <https://github.com/django/django/commit/518d406e53>`__
* Django 0.91 `(patch) <https://github.com/django/django/commit/518d406e53>`__
* Django 0.95 `(patch) <https://github.com/django/django/commit/a132d411c6>`__ (released January 21 2007)
* Django 0.90 :commit:`(patch) <518d406e53>`
* Django 0.91 :commit:`(patch) <518d406e53>`
* Django 0.95 :commit:`(patch) <a132d411c6>` (released January 21 2007)
January 21, 2007 - :cve:`2007-0405`
-----------------------------------
@ -59,7 +59,7 @@ Apparent "caching" of authenticated user. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 0.95 `(patch) <https://github.com/django/django/commit/e89f0a6558>`__
* Django 0.95 :commit:`(patch) <e89f0a6558>`
Issues under Django's security process
======================================
@ -76,9 +76,9 @@ description <https://www.djangoproject.com/weblog/2007/oct/26/security-fix/>`__
Versions affected
~~~~~~~~~~~~~~~~~
* Django 0.91 `(patch) <https://github.com/django/django/commit/8bc36e726c9e8c75c681d3ad232df8e882aaac81>`__
* Django 0.95 `(patch) <https://github.com/django/django/commit/412ed22502e11c50dbfee854627594f0e7e2c234>`__
* Django 0.96 `(patch) <https://github.com/django/django/commit/7dd2dd08a79e388732ce00e2b5514f15bd6d0f6f>`__
* Django 0.91 :commit:`(patch) <8bc36e726c9e8c75c681d3ad232df8e882aaac81>`
* Django 0.95 :commit:`(patch) <412ed22502e11c50dbfee854627594f0e7e2c234>`
* Django 0.96 :commit:`(patch) <7dd2dd08a79e388732ce00e2b5514f15bd6d0f6f>`
May 14, 2008 - :cve:`2008-2302`
-------------------------------
@ -89,9 +89,9 @@ XSS via admin login redirect. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 0.91 `(patch) <https://github.com/django/django/commit/50ce7fb57d>`__
* Django 0.95 `(patch) <https://github.com/django/django/commit/50ce7fb57d>`__
* Django 0.96 `(patch) <https://github.com/django/django/commit/7791e5c050>`__
* Django 0.91 :commit:`(patch) <50ce7fb57d>`
* Django 0.95 :commit:`(patch) <50ce7fb57d>`
* Django 0.96 :commit:`(patch) <7791e5c050>`
September 2, 2008 - :cve:`2008-3909`
------------------------------------
@ -102,9 +102,9 @@ CSRF via preservation of POST data during admin login. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 0.91 `(patch) <https://github.com/django/django/commit/44debfeaa4473bd28872c735dd3d9afde6886752>`__
* Django 0.95 `(patch) <https://github.com/django/django/commit/aee48854a164382c655acb9f18b3c06c3d238e81>`__
* Django 0.96 `(patch) <https://github.com/django/django/commit/7e0972bded362bc4b851c109df2c8a6548481a8e>`__
* Django 0.91 :commit:`(patch) <44debfeaa4473bd28872c735dd3d9afde6886752>`
* Django 0.95 :commit:`(patch) <aee48854a164382c655acb9f18b3c06c3d238e81>`
* Django 0.96 :commit:`(patch) <7e0972bded362bc4b851c109df2c8a6548481a8e>`
July 28, 2009 - :cve:`2009-2659`
--------------------------------
@ -115,8 +115,8 @@ Directory-traversal in development server media handler. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 0.96 `(patch) <https://github.com/django/django/commit/da85d76fd6>`__
* Django 1.0 `(patch) <https://github.com/django/django/commit/df7f917b7f>`__
* Django 0.96 :commit:`(patch) <da85d76fd6>`
* Django 1.0 :commit:`(patch) <df7f917b7f>`
October 9, 2009 - :cve:`2009-3965`
----------------------------------
@ -127,8 +127,8 @@ description <https://www.djangoproject.com/weblog/2009/oct/09/security/>`__
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.0 `(patch) <https://github.com/django/django/commit/594a28a904>`__
* Django 1.1 `(patch) <https://github.com/django/django/commit/e3e992e18b>`__
* Django 1.0 :commit:`(patch) <594a28a904>`
* Django 1.1 :commit:`(patch) <e3e992e18b>`
September 8, 2010 - :cve:`2010-3082`
------------------------------------
@ -139,7 +139,7 @@ XSS via trusting unsafe cookie value. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.2 `(patch) <https://github.com/django/django/commit/7f84657b6b>`__
* Django 1.2 :commit:`(patch) <7f84657b6b>`
December 22, 2010 - :cve:`2010-4534`
------------------------------------
@ -150,8 +150,8 @@ Information leakage in administrative interface. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.1 `(patch) <https://github.com/django/django/commit/17084839fd>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/85207a245b>`__
* Django 1.1 :commit:`(patch) <17084839fd>`
* Django 1.2 :commit:`(patch) <85207a245b>`
December 22, 2010 - :cve:`2010-4535`
------------------------------------
@ -162,8 +162,8 @@ Denial-of-service in password-reset mechanism. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.1 `(patch) <https://github.com/django/django/commit/7f8dd9cbac>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/d5d8942a16>`__
* Django 1.1 :commit:`(patch) <7f8dd9cbac>`
* Django 1.2 :commit:`(patch) <d5d8942a16>`
February 8, 2011 - :cve:`2011-0696`
-----------------------------------
@ -174,8 +174,8 @@ CSRF via forged HTTP headers. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.1 `(patch) <https://github.com/django/django/commit/408c5c873c>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/818e70344e>`__
* Django 1.1 :commit:`(patch) <408c5c873c>`
* Django 1.2 :commit:`(patch) <818e70344e>`
February 8, 2011 - :cve:`2011-0697`
-----------------------------------
@ -186,8 +186,8 @@ XSS via unsanitized names of uploaded files. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.1 `(patch) <https://github.com/django/django/commit/1966786d2d>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/1f814a9547>`__
* Django 1.1 :commit:`(patch) <1966786d2d>`
* Django 1.2 :commit:`(patch) <1f814a9547>`
February 8, 2011 - :cve:`2011-0698`
-----------------------------------
@ -198,8 +198,8 @@ description <https://www.djangoproject.com/weblog/2011/feb/08/security/>`__
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.1 `(patch) <https://github.com/django/django/commit/570a32a047>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/194566480b>`__
* Django 1.1 :commit:`(patch) <570a32a047>`
* Django 1.2 :commit:`(patch) <194566480b>`
September 9, 2011 - :cve:`2011-4136`
------------------------------------
@ -210,8 +210,8 @@ Session manipulation when using memory-cache-backed session. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.2 `(patch) <https://github.com/django/django/commit/ac7c3a110f>`__
* Django 1.3 `(patch) <https://github.com/django/django/commit/fbe2eead2f>`__
* Django 1.2 :commit:`(patch) <ac7c3a110f>`
* Django 1.3 :commit:`(patch) <fbe2eead2f>`
September 9, 2011 - :cve:`2011-4137`
------------------------------------
@ -222,8 +222,8 @@ Denial-of-service via ``URLField.verify_exists``. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.2 `(patch) <https://github.com/django/django/commit/7268f8af86>`__
* Django 1.3 `(patch) <https://github.com/django/django/commit/1a76dbefdf>`__
* Django 1.2 :commit:`(patch) <7268f8af86>`
* Django 1.3 :commit:`(patch) <1a76dbefdf>`
September 9, 2011 - :cve:`2011-4138`
------------------------------------
@ -235,8 +235,8 @@ Information leakage/arbitrary request issuance via ``URLField.verify_exists``.
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.2: `(patch) <https://github.com/django/django/commit/7268f8af86>`__
* Django 1.3: `(patch) <https://github.com/django/django/commit/1a76dbefdf>`__
* Django 1.2: :commit:`(patch) <7268f8af86>`
* Django 1.3: :commit:`(patch) <1a76dbefdf>`
September 9, 2011 - :cve:`2011-4139`
------------------------------------
@ -247,8 +247,8 @@ September 9, 2011 - :cve:`2011-4139`
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.2 `(patch) <https://github.com/django/django/commit/c613af4d64>`__
* Django 1.3 `(patch) <https://github.com/django/django/commit/2f7fadc38e>`__
* Django 1.2 :commit:`(patch) <c613af4d64>`
* Django 1.3 :commit:`(patch) <2f7fadc38e>`
September 9, 2011 - :cve:`2011-4140`
------------------------------------
@ -273,8 +273,8 @@ XSS via failure to validate redirect scheme. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3: `(patch) <https://github.com/django/django/commit/4dea4883e6c50d75f215a6b9bcbd95273f57c72d>`__
* Django 1.4: `(patch) <https://github.com/django/django/commit/e34685034b60be1112160e76091e5aee60149fa1>`__
* Django 1.3: :commit:`(patch) <4dea4883e6c50d75f215a6b9bcbd95273f57c72d>`
* Django 1.4: :commit:`(patch) <e34685034b60be1112160e76091e5aee60149fa1>`
July 30, 2012 - :cve:`2012-3443`
--------------------------------
@ -285,8 +285,8 @@ Denial-of-service via compressed image files. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3: `(patch) <https://github.com/django/django/commit/b2eb4787a0fff9c9993b78be5c698e85108f3446>`__
* Django 1.4: `(patch) <https://github.com/django/django/commit/c14f325c4eef628bc7bfd8873c3a72aeb0219141>`__
* Django 1.3: :commit:`(patch) <b2eb4787a0fff9c9993b78be5c698e85108f3446>`
* Django 1.4: :commit:`(patch) <c14f325c4eef628bc7bfd8873c3a72aeb0219141>`
July 30, 2012 - :cve:`2012-3444`
--------------------------------
@ -297,8 +297,8 @@ Denial-of-service via large image files. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3 `(patch) <https://github.com/django/django/commit/9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/da33d67181b53fe6cc737ac1220153814a1509f6>`__
* Django 1.3 :commit:`(patch) <9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155>`
* Django 1.4 :commit:`(patch) <da33d67181b53fe6cc737ac1220153814a1509f6>`
October 17, 2012 - :cve:`2012-4520`
-----------------------------------
@ -309,8 +309,8 @@ October 17, 2012 - :cve:`2012-4520`
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3 `(patch) <https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3>`__
* Django 1.3 :commit:`(patch) <b45c377f8f488955e0c7069cad3f3dd21910b071>`
* Django 1.4 :commit:`(patch) <92d3430f12171f16f566c9050c40feefb830a4a3>`
December 10, 2012 - No CVE 1
----------------------------
@ -321,8 +321,8 @@ Additional hardening of ``Host`` header handling. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3 `(patch) <https://github.com/django/django/commit/2da4ace0bc1bc1d79bf43b368cb857f6f0cd6b1b>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/319627c184e71ae267d6b7f000e293168c7b6e09>`__
* Django 1.3 :commit:`(patch) <2da4ace0bc1bc1d79bf43b368cb857f6f0cd6b1b>`
* Django 1.4 :commit:`(patch) <319627c184e71ae267d6b7f000e293168c7b6e09>`
December 10, 2012 - No CVE 2
----------------------------
@ -333,8 +333,8 @@ Additional hardening of redirect validation. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3: `(patch) <https://github.com/django/django/commit/1515eb46daa0897ba5ad5f0a2db8969255f1b343>`__
* Django 1.4: `(patch) <https://github.com/django/django/commit/b2ae0a63aeec741f1e51bac9a95a27fd635f9652>`__
* Django 1.3: :commit:`(patch) <1515eb46daa0897ba5ad5f0a2db8969255f1b343>`
* Django 1.4: :commit:`(patch) <b2ae0a63aeec741f1e51bac9a95a27fd635f9652>`
February 19, 2013 - No CVE
--------------------------
@ -345,8 +345,8 @@ Additional hardening of ``Host`` header handling. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3 `(patch) <https://github.com/django/django/commit/27cd872e6e36a81d0bb6f5b8765a1705fecfc253>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/9936fdb11d0bbf0bd242f259bfb97bbf849d16f8>`__
* Django 1.3 :commit:`(patch) <27cd872e6e36a81d0bb6f5b8765a1705fecfc253>`
* Django 1.4 :commit:`(patch) <9936fdb11d0bbf0bd242f259bfb97bbf849d16f8>`
February 19, 2013 - :cve:`2013-1664` / :cve:`2013-1665`
-------------------------------------------------------
@ -357,8 +357,8 @@ Entity-based attacks against Python XML libraries. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3 `(patch) <https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40>`__
* Django 1.3 :commit:`(patch) <d19a27066b2247102e65412aa66917aff0091112>`
* Django 1.4 :commit:`(patch) <1c60d07ba23e0350351c278ad28d0bd5aa410b40>`
February 19, 2013 - :cve:`2013-0305`
------------------------------------
@ -369,8 +369,8 @@ Information leakage via admin history log. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3 `(patch) <https://github.com/django/django/commit/d3a45e10c8ac8268899999129daa27652ec0da35>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/0e7861aec73702f7933ce2a93056f7983939f0d6>`__
* Django 1.3 :commit:`(patch) <d3a45e10c8ac8268899999129daa27652ec0da35>`
* Django 1.4 :commit:`(patch) <0e7861aec73702f7933ce2a93056f7983939f0d6>`
February 19, 2013 - :cve:`2013-0306`
------------------------------------
@ -381,8 +381,8 @@ Denial-of-service via formset ``max_num`` bypass. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.3 `(patch) <https://github.com/django/django/commit/d7094bbce8cb838f3b40f504f198c098ff1cf727>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/0cc350a896f70ace18280410eb616a9197d862b0>`__
* Django 1.3 :commit:`(patch) <d7094bbce8cb838f3b40f504f198c098ff1cf727>`
* Django 1.4 :commit:`(patch) <0cc350a896f70ace18280410eb616a9197d862b0>`
August 13, 2013 - :cve:`2013-4249`
----------------------------------
@ -393,7 +393,7 @@ XSS via admin trusting ``URLField`` values. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.5 `(patch) <https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78>`__
* Django 1.5 :commit:`(patch) <90363e388c61874add3f3557ee654a996ec75d78>`
August 13, 2013 - :cve:`2013-6044`
----------------------------------
@ -404,8 +404,8 @@ Possible XSS via unvalidated URL redirect schemes. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f>`__
* Django 1.4 :commit:`(patch) <ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a>`
* Django 1.5 :commit:`(patch) <1a274ccd6bc1afbdac80344c9b6e5810c1162b5f>`
September 10, 2013 - :cve:`2013-4315`
-------------------------------------
@ -416,8 +416,8 @@ Directory-traversal via ``ssi`` template tag. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/87d2750b39f6f2d54b7047225521a44dcd37e896>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/988b61c550d798f9a66d17ee0511fb7a9a7f33ca>`__
* Django 1.4 :commit:`(patch) <87d2750b39f6f2d54b7047225521a44dcd37e896>`
* Django 1.5 :commit:`(patch) <988b61c550d798f9a66d17ee0511fb7a9a7f33ca>`
September 14, 2013 - :cve:`2013-1443`
-------------------------------------
@ -428,8 +428,8 @@ Denial-of-service via large passwords. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch <https://github.com/django/django/commit/3f3d887a6844ec2db743fee64c9e53e04d39a368>`__ and `Python compatibility fix) <https://github.com/django/django/commit/6903d1690a92aa040adfb0c8eb37cf62e4206714>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc>`__
* Django 1.4 :commit:`(patch <3f3d887a6844ec2db743fee64c9e53e04d39a368>` and :commit:`Python compatibility fix) <6903d1690a92aa040adfb0c8eb37cf62e4206714>`
* Django 1.5 :commit:`(patch) <22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc>`
April 21, 2014 - :cve:`2014-0472`
---------------------------------
@ -440,10 +440,10 @@ Unexpected code execution using ``reverse()``. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/c1a8c420fe4b27fb2caf5e46d23b5712fc0ac535>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/2a5bcb69f42b84464b24b5c835dca6467b6aa7f1>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/4352a50871e239ebcdf64eee6f0b88e714015c1b>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/546740544d7f69254a67b06a3fc7fa0c43512958>`__
* Django 1.4 :commit:`(patch) <c1a8c420fe4b27fb2caf5e46d23b5712fc0ac535>`
* Django 1.5 :commit:`(patch) <2a5bcb69f42b84464b24b5c835dca6467b6aa7f1>`
* Django 1.6 :commit:`(patch) <4352a50871e239ebcdf64eee6f0b88e714015c1b>`
* Django 1.7 :commit:`(patch) <546740544d7f69254a67b06a3fc7fa0c43512958>`
April 21, 2014 - :cve:`2014-0473`
---------------------------------
@ -454,10 +454,10 @@ Caching of anonymous pages could reveal CSRF token. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/1170f285ddd6a94a65f911a27788ba49ca08c0b0>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/6872f42757d7ef6a97e0b6ec5db4d2615d8a2bd8>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/d63e20942f3024f24cb8cd85a49461ba8a9b6736>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/380545bf85cbf17fc698d136815b7691f8d023ca>`__
* Django 1.4 :commit:`(patch) <1170f285ddd6a94a65f911a27788ba49ca08c0b0>`
* Django 1.5 :commit:`(patch) <6872f42757d7ef6a97e0b6ec5db4d2615d8a2bd8>`
* Django 1.6 :commit:`(patch) <d63e20942f3024f24cb8cd85a49461ba8a9b6736>`
* Django 1.7 :commit:`(patch) <380545bf85cbf17fc698d136815b7691f8d023ca>`
April 21, 2014 - :cve:`2014-0474`
---------------------------------
@ -468,10 +468,10 @@ MySQL typecasting causes unexpected query results. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/aa80f498de6d687e613860933ac58433ab71ea4b>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/985434fb1d6bf2335bf96c6ebf91c3674f1f399f>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/34526c2f56b863c2103655a0893ac801667e86ea>`__
* Django 1.4 :commit:`(patch) <aa80f498de6d687e613860933ac58433ab71ea4b>`
* Django 1.5 :commit:`(patch) <985434fb1d6bf2335bf96c6ebf91c3674f1f399f>`
* Django 1.6 :commit:`(patch) <5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292>`
* Django 1.7 :commit:`(patch) <34526c2f56b863c2103655a0893ac801667e86ea>`
May 18, 2014 - :cve:`2014-1418`
-------------------------------
@ -482,10 +482,10 @@ Caches may be allowed to store and serve private data. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/28e23306aa53bbbb8fb87db85f99d970b051026c>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/4001ec8698f577b973c5a540801d8a0bbea1205b>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/7fef18ba9e5a8b47bc24b5bb259c8bf3d3879f2a>`__
* Django 1.4 :commit:`(patch) <28e23306aa53bbbb8fb87db85f99d970b051026c>`
* Django 1.5 :commit:`(patch) <4001ec8698f577b973c5a540801d8a0bbea1205b>`
* Django 1.6 :commit:`(patch) <1abcf3a808b35abae5d425ed4d44cb6e886dc769>`
* Django 1.7 :commit:`(patch) <7fef18ba9e5a8b47bc24b5bb259c8bf3d3879f2a>`
May 18, 2014 - :cve:`2014-3730`
-------------------------------
@ -496,10 +496,10 @@ Malformed URLs from user input incorrectly validated. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/ad32c218850ad40972dcef57beb460f8c979dd6d>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/e7b0cace455c2da24492660636bfd48c45a19cdf>`__
* Django 1.4 :commit:`(patch) <7feb54bbae3f637ab3c4dd4831d4385964f574df>`
* Django 1.5 :commit:`(patch) <ad32c218850ad40972dcef57beb460f8c979dd6d>`
* Django 1.6 :commit:`(patch) <601107524523bca02376a0ddc1a06c6fdb8f22f3>`
* Django 1.7 :commit:`(patch) <e7b0cace455c2da24492660636bfd48c45a19cdf>`
August 20, 2014 - :cve:`2014-0480`
----------------------------------
@ -510,10 +510,10 @@ August 20, 2014 - :cve:`2014-0480`
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/c2fe73133b62a1d9e8f7a6b43966570b14618d7e>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/45ac9d4fb087d21902469fc22643f5201d41a0cd>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/da051da8df5e69944745072611351d4cfc6435d5>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/bf650a2ee78c6d1f4544a875dcc777cf27fe93e9>`__
* Django 1.4 :commit:`(patch) <c2fe73133b62a1d9e8f7a6b43966570b14618d7e>`
* Django 1.5 :commit:`(patch) <45ac9d4fb087d21902469fc22643f5201d41a0cd>`
* Django 1.6 :commit:`(patch) <da051da8df5e69944745072611351d4cfc6435d5>`
* Django 1.7 :commit:`(patch) <bf650a2ee78c6d1f4544a875dcc777cf27fe93e9>`
August 20, 2014 - :cve:`2014-0481`
----------------------------------
@ -524,10 +524,10 @@ File upload denial of service. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/30042d475bf084c6723c6217a21598d9247a9c41>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/26cd48e166ac4d84317c8ee6d63ac52a87e8da99>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/dd0c3f4ee1a30c1a1e6055061c6ba6e58c6b54d1>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/3123f8452cf49071be9110e277eea60ba0032216>`__
* Django 1.4 :commit:`(patch) <30042d475bf084c6723c6217a21598d9247a9c41>`
* Django 1.5 :commit:`(patch) <26cd48e166ac4d84317c8ee6d63ac52a87e8da99>`
* Django 1.6 :commit:`(patch) <dd0c3f4ee1a30c1a1e6055061c6ba6e58c6b54d1>`
* Django 1.7 :commit:`(patch) <3123f8452cf49071be9110e277eea60ba0032216>`
August 20, 2014 - :cve:`2014-0482`
----------------------------------
@ -538,10 +538,10 @@ August 20, 2014 - :cve:`2014-0482`
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/c9e3b9949cd55f090591fbdc4a114fcb8368b6d9>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/dd68f319b365f6cb38c5a6c106faf4f6142d7d88>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/0268b855f9eab3377f2821164ef3e66037789e09>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/1a45d059c70385fcd6f4a3955f3b4e4cc96d0150>`__
* Django 1.4 :commit:`(patch) <c9e3b9949cd55f090591fbdc4a114fcb8368b6d9>`
* Django 1.5 :commit:`(patch) <dd68f319b365f6cb38c5a6c106faf4f6142d7d88>`
* Django 1.6 :commit:`(patch) <0268b855f9eab3377f2821164ef3e66037789e09>`
* Django 1.7 :commit:`(patch) <1a45d059c70385fcd6f4a3955f3b4e4cc96d0150>`
August 20, 2014 - :cve:`2014-0483`
----------------------------------
@ -552,10 +552,10 @@ Data leakage via querystring manipulation in admin.
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/027bd348642007617518379f8b02546abacaa6e0>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/2a446c896e7c814661fb9c4f212b071b2a7fa446>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/f7c494f2506250b8cb5923714360a3642ed63e0f>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6>`__
* Django 1.4 :commit:`(patch) <027bd348642007617518379f8b02546abacaa6e0>`
* Django 1.5 :commit:`(patch) <2a446c896e7c814661fb9c4f212b071b2a7fa446>`
* Django 1.6 :commit:`(patch) <f7c494f2506250b8cb5923714360a3642ed63e0f>`
* Django 1.7 :commit:`(patch) <2b31342cdf14fc20e07c43d258f1e7334ad664a6>`
January 13, 2015 - :cve:`2015-0219`
-----------------------------------
@ -566,9 +566,9 @@ WSGI header spoofing via underscore/dash conflation. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/4f6fffc1dc429f1ad428ecf8e6620739e8837450>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/d7597b31d5c03106eeba4be14a33b32a5e25f4ee>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/41b4bc73ee0da7b2e09f4af47fc1fd21144c710f>`__
* Django 1.4 :commit:`(patch) <4f6fffc1dc429f1ad428ecf8e6620739e8837450>`
* Django 1.6 :commit:`(patch) <d7597b31d5c03106eeba4be14a33b32a5e25f4ee>`
* Django 1.7 :commit:`(patch) <41b4bc73ee0da7b2e09f4af47fc1fd21144c710f>`
January 13, 2015 - :cve:`2015-0220`
-----------------------------------
@ -579,9 +579,9 @@ description <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/4c241f1b710da6419d9dca160e80b23b82db7758>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/72e0b033662faa11bb7f516f18a132728aa0ae28>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89>`__
* Django 1.4 :commit:`(patch) <4c241f1b710da6419d9dca160e80b23b82db7758>`
* Django 1.6 :commit:`(patch) <72e0b033662faa11bb7f516f18a132728aa0ae28>`
* Django 1.7 :commit:`(patch) <de67dedc771ad2edec15c1d00c083a1a084e1e89>`
January 13, 2015 - :cve:`2015-0221`
-----------------------------------
@ -592,9 +592,9 @@ description <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/d020da6646c5142bc092247d218a3d1ce3e993f7>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/553779c4055e8742cc832ed525b9ee34b174934f>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/818e59a3f0fbadf6c447754d202d88df025f8f2a>`__
* Django 1.4 :commit:`(patch) <d020da6646c5142bc092247d218a3d1ce3e993f7>`
* Django 1.6 :commit:`(patch) <553779c4055e8742cc832ed525b9ee34b174934f>`
* Django 1.7 :commit:`(patch) <818e59a3f0fbadf6c447754d202d88df025f8f2a>`
January 13, 2015 - :cve:`2015-0222`
-----------------------------------
@ -605,8 +605,8 @@ Database denial-of-service with ``ModelMultipleChoiceField``. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.6 `(patch) <https://github.com/django/django/commit/d7a06ee7e571b6dad07c0f5b519b1db02e2a476c>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/bcfb47780ce7caecb409a9e9c1c314266e41d392>`__
* Django 1.6 :commit:`(patch) <d7a06ee7e571b6dad07c0f5b519b1db02e2a476c>`
* Django 1.7 :commit:`(patch) <bcfb47780ce7caecb409a9e9c1c314266e41d392>`
March 9, 2015 - :cve:`2015-2241`
--------------------------------
@ -617,8 +617,8 @@ XSS attack via properties in ``ModelAdmin.readonly_fields``. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.7 `(patch) <https://github.com/django/django/commit/d16e4e1d6f95e6f46bff53cc4fd0ab398b8e5059>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5>`_
* Django 1.7 :commit:`(patch) <d16e4e1d6f95e6f46bff53cc4fd0ab398b8e5059>`
* Django 1.8 :commit:`(patch) <2654e1b93923bac55f12b4e66c5e39b16695ace5>`
March 18, 2015 - :cve:`2015-2316`
---------------------------------
@ -629,9 +629,9 @@ Denial-of-service possibility with ``strip_tags()``. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.6 `(patch) <https://github.com/django/django/commit/b6b3cb9899214a23ebb0f4ebf0e0b300b0ee524f>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd>`__
* Django 1.6 :commit:`(patch) <b6b3cb9899214a23ebb0f4ebf0e0b300b0ee524f>`
* Django 1.7 :commit:`(patch) <e63363f8e075fa8d66326ad6a1cc3391cc95cd97>`
* Django 1.8 :commit:`(patch) <5447709a571cd5d95971f1d5d21d4a7edcf85bbd>`
March 18, 2015 - :cve:`2015-2317`
---------------------------------
@ -642,10 +642,10 @@ description <https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.4 `(patch) <https://github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b>`__
* Django 1.6 `(patch) <https://github.com/django/django/commit/5510f070711540aaa8d3707776cd77494e688ef9>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/770427c2896a078925abfca2317486b284d22f04>`__
* Django 1.4 :commit:`(patch) <2342693b31f740a422abf7267c53b4e7bc487c1b>`
* Django 1.6 :commit:`(patch) <5510f070711540aaa8d3707776cd77494e688ef9>`
* Django 1.7 :commit:`(patch) <2a4113dbd532ce952308992633d802dc169a75f1>`
* Django 1.8 :commit:`(patch) <770427c2896a078925abfca2317486b284d22f04>`
May 20, 2015 - :cve:`2015-3982`
-------------------------------
@ -656,7 +656,7 @@ Fixed session flushing in the cached_db backend. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.8 `(patch) <https://github.com/django/django/commit/31cb25adecba930bdeee4556709f5a1c42d88fd6>`__
* Django 1.8 :commit:`(patch) <31cb25adecba930bdeee4556709f5a1c42d88fd6>`
July 8, 2015 - :cve:`2015-5143`
-------------------------------
@ -667,9 +667,9 @@ description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.8 `(patch) <https://github.com/django/django/commit/66d12d1ababa8f062857ee5eb43276493720bf16>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9>`__
* Django 1.8 :commit:`(patch) <66d12d1ababa8f062857ee5eb43276493720bf16>`
* Django 1.7 :commit:`(patch) <1828f4341ec53a8684112d24031b767eba557663>`
* Django 1.4 :commit:`(patch) <2e47f3e401c29bc2ba5ab794d483cb0820855fb9>`
July 8, 2015 - :cve:`2015-5144`
-------------------------------
@ -680,9 +680,9 @@ description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.8 `(patch) <https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a>`__
* Django 1.8 :commit:`(patch) <574dd5e0b0fbb877ae5827b1603d298edc9bb2a0>`
* Django 1.7 :commit:`(patch) <ae49b4d994656bc037513dcd064cb9ce5bb85649>`
* Django 1.4 :commit:`(patch) <1ba1cdce7d58e6740fe51955d945b56ae51d072a>`
July 8, 2015 - :cve:`2015-5145`
-------------------------------
@ -693,7 +693,7 @@ Denial-of-service possibility in URL validation. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.8 `(patch) <https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c>`__
* Django 1.8 :commit:`(patch) <8f9a4d3a2bc42f14bb437defd30c7315adbff22c>`
August 18, 2015 - :cve:`2015-5963` / :cve:`2015-5964`
-----------------------------------------------------
@ -704,9 +704,9 @@ Denial-of-service possibility in ``logout()`` view by filling session store.
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.8 `(patch) <https://github.com/django/django/commit/2eb86b01d7b59be06076f6179a454d0fd0afaff6>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/2f5485346ee6f84b4e52068c04e043092daf55f7>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/575f59f9bc7c59a5e41a081d1f5f55fc859c5012>`__
* Django 1.8 :commit:`(patch) <2eb86b01d7b59be06076f6179a454d0fd0afaff6>`
* Django 1.7 :commit:`(patch) <2f5485346ee6f84b4e52068c04e043092daf55f7>`
* Django 1.4 :commit:`(patch) <575f59f9bc7c59a5e41a081d1f5f55fc859c5012>`
November 24, 2015 - :cve:`2015-8213`
------------------------------------
@ -717,8 +717,8 @@ Settings leak possibility in ``date`` template filter. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.8 `(patch) <https://github.com/django/django/commit/9f83fc2f66f5a0bac7c291aec55df66050bb6991>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/8a01c6b53169ee079cb21ac5919fdafcc8c5e172>`__
* Django 1.8 :commit:`(patch) <9f83fc2f66f5a0bac7c291aec55df66050bb6991>`
* Django 1.7 :commit:`(patch) <8a01c6b53169ee079cb21ac5919fdafcc8c5e172>`
February 1, 2016 - :cve:`2016-2048`
-----------------------------------
@ -730,7 +730,7 @@ User with "change" but not "add" permission can create objects for
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.9 `(patch) <https://github.com/django/django/commit/adbca5e4db42542575734b8e5d26961c8ada7265>`__
* Django 1.9 :commit:`(patch) <adbca5e4db42542575734b8e5d26961c8ada7265>`
March 1, 2016 - :cve:`2016-2512`
--------------------------------
@ -742,8 +742,8 @@ containing basic auth. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.9 `(patch) <https://github.com/django/django/commit/fc6d147a63f89795dbcdecb0559256470fff4380>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350>`__
* Django 1.9 :commit:`(patch) <fc6d147a63f89795dbcdecb0559256470fff4380>`
* Django 1.8 :commit:`(patch) <382ab137312961ad62feb8109d70a5a581fe8350>`
March 1, 2016 - :cve:`2016-2513`
--------------------------------
@ -755,8 +755,8 @@ upgrade. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.9 `(patch) <https://github.com/django/django/commit/af7d09b0c5c6ab68e629fd9baf736f9dd203b18e>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/f4e6e02f7713a6924d16540be279909ff4091eb6>`__
* Django 1.9 :commit:`(patch) <af7d09b0c5c6ab68e629fd9baf736f9dd203b18e>`
* Django 1.8 :commit:`(patch) <f4e6e02f7713a6924d16540be279909ff4091eb6>`
July 18, 2016 - :cve:`2016-6186`
--------------------------------
@ -767,8 +767,8 @@ XSS in admin's add/change related popup. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.9 `(patch) <https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d>`__
* Django 1.9 :commit:`(patch) <d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158>`
* Django 1.8 :commit:`(patch) <f68e5a99164867ab0e071a936470958ed867479d>`
September 26, 2016 - :cve:`2016-7401`
-------------------------------------
@ -779,8 +779,8 @@ CSRF protection bypass on a site with Google Analytics. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.9 `(patch) <https://github.com/django/django/commit/d1bc980db1c0fffd6d60677e62f70beadb9fe64a>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/6118ab7d0676f0d622278e5be215f14fb5410b6a>`__
* Django 1.9 :commit:`(patch) <d1bc980db1c0fffd6d60677e62f70beadb9fe64a>`
* Django 1.8 :commit:`(patch) <6118ab7d0676f0d622278e5be215f14fb5410b6a>`
November 1, 2016 - :cve:`2016-9013`
-----------------------------------
@ -791,9 +791,9 @@ description <https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.10 `(patch) <https://github.com/django/django/commit/34e10720d81b8d407aa14d763b6a7fe8f13b4f2e>`__
* Django 1.9 `(patch) <https://github.com/django/django/commit/4844d86c7728c1a5a3bbce4ad336a8d32304072b>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/70f99952965a430daf69eeb9947079aae535d2d0>`__
* Django 1.10 :commit:`(patch) <34e10720d81b8d407aa14d763b6a7fe8f13b4f2e>`
* Django 1.9 :commit:`(patch) <4844d86c7728c1a5a3bbce4ad336a8d32304072b>`
* Django 1.8 :commit:`(patch) <70f99952965a430daf69eeb9947079aae535d2d0>`
November 1, 2016 - :cve:`2016-9014`
-----------------------------------
@ -804,9 +804,9 @@ DNS rebinding vulnerability when ``DEBUG=True``. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.10 `(patch) <https://github.com/django/django/commit/884e113838e5a72b4b0ec9e5e87aa480f6aa4472>`__
* Django 1.9 `(patch) <https://github.com/django/django/commit/45acd6d836895a4c36575f48b3fb36a3dae98d19>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/c401ae9a7dfb1a94a8a61927ed541d6f93089587>`__
* Django 1.10 :commit:`(patch) <884e113838e5a72b4b0ec9e5e87aa480f6aa4472>`
* Django 1.9 :commit:`(patch) <45acd6d836895a4c36575f48b3fb36a3dae98d19>`
* Django 1.8 :commit:`(patch) <c401ae9a7dfb1a94a8a61927ed541d6f93089587>`
April 4, 2017 - :cve:`2017-7233`
--------------------------------
@ -817,9 +817,9 @@ Open redirect and possible XSS attack via user-supplied numeric redirect URLs.
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.10 `(patch) <https://github.com/django/django/commit/f824655bc2c50b19d2f202d7640785caabc82787>`__
* Django 1.9 `(patch) <https://github.com/django/django/commit/254326cb3682389f55f886804d2c43f7b9f23e4f>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/8339277518c7d8ec280070a780915304654e3b66>`__
* Django 1.10 :commit:`(patch) <f824655bc2c50b19d2f202d7640785caabc82787>`
* Django 1.9 :commit:`(patch) <254326cb3682389f55f886804d2c43f7b9f23e4f>`
* Django 1.8 :commit:`(patch) <8339277518c7d8ec280070a780915304654e3b66>`
April 4, 2017 - :cve:`2017-7234`
--------------------------------
@ -830,9 +830,9 @@ description <https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.10 `(patch) <https://github.com/django/django/commit/2a9f6ef71b8e23fd267ee2be1be26dde8ab67037>`__
* Django 1.9 `(patch) <https://github.com/django/django/commit/5f1ffb07afc1e59729ce2b283124116d6c0659e4>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/4a6b945dffe8d10e7cec107d93e6efaebfbded29>`__
* Django 1.10 :commit:`(patch) <2a9f6ef71b8e23fd267ee2be1be26dde8ab67037>`
* Django 1.9 :commit:`(patch) <5f1ffb07afc1e59729ce2b283124116d6c0659e4>`
* Django 1.8 :commit:`(patch) <4a6b945dffe8d10e7cec107d93e6efaebfbded29>`
September 5, 2017 - :cve:`2017-12794`
-------------------------------------
@ -843,8 +843,8 @@ description <https://www.djangoproject.com/weblog/2017/sep/05/security-releases/
Versions affected
~~~~~~~~~~~~~~~~~
* Django 1.11 `(patch) <https://github.com/django/django/commit/e35a0c56086924f331e9422daa266e907a4784cc>`__
* Django 1.10 `(patch) <https://github.com/django/django/commit/58e08e80e362db79eb0fd775dc81faad90dca47a>`__
* Django 1.11 :commit:`(patch) <e35a0c56086924f331e9422daa266e907a4784cc>`
* Django 1.10 :commit:`(patch) <58e08e80e362db79eb0fd775dc81faad90dca47a>`
February 1, 2018 - :cve:`2018-6188`
-----------------------------------
@ -855,8 +855,8 @@ Information leakage in ``AuthenticationForm``. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 2.0 `(patch) <https://github.com/django/django/commit/c37bb28677295f6edda61d8ac461014ef0d3aeb2>`__
* Django 1.11 `(patch) <https://github.com/django/django/commit/57b95fedad5e0b83fc9c81466b7d1751c6427aae>`__
* Django 2.0 :commit:`(patch) <c37bb28677295f6edda61d8ac461014ef0d3aeb2>`
* Django 1.11 :commit:`(patch) <57b95fedad5e0b83fc9c81466b7d1751c6427aae>`
March 6, 2018 - :cve:`2018-7536`
--------------------------------
@ -868,9 +868,9 @@ filters. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 2.0 `(patch) <https://github.com/django/django/commit/e157315da3ae7005fa0683ffc9751dbeca7306c8>`__
* Django 1.11 `(patch) <https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/1ca63a66ef3163149ad822701273e8a1844192c2>`__
* Django 2.0 :commit:`(patch) <e157315da3ae7005fa0683ffc9751dbeca7306c8>`
* Django 1.11 :commit:`(patch) <abf89d729f210c692a50e0ad3f75fb6bec6fae16>`
* Django 1.8 :commit:`(patch) <1ca63a66ef3163149ad822701273e8a1844192c2>`
March 6, 2018 - :cve:`2018-7537`
--------------------------------
@ -882,9 +882,9 @@ Denial-of-service possibility in ``truncatechars_html`` and
Versions affected
~~~~~~~~~~~~~~~~~
* Django 2.0 `(patch) <https://github.com/django/django/commit/94c5da1d17a6b0d378866c66b605102c19f7988c>`__
* Django 1.11 `(patch) <https://github.com/django/django/commit/a91436360b79a6ff995c3e5018bcc666dfaf1539>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/d17974a287a6ea2e361daff88fcc004cbd6835fa>`__
* Django 2.0 :commit:`(patch) <94c5da1d17a6b0d378866c66b605102c19f7988c>`
* Django 1.11 :commit:`(patch) <a91436360b79a6ff995c3e5018bcc666dfaf1539>`
* Django 1.8 :commit:`(patch) <d17974a287a6ea2e361daff88fcc004cbd6835fa>`
August 1, 2018 - :cve:`2018-14574`
----------------------------------
@ -895,9 +895,9 @@ Open redirect possibility in ``CommonMiddleware``. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 2.1 `(patch) <https://github.com/django/django/commit/c4e5ff7fdb5fce447675e90291fd33fddd052b3c>`__
* Django 2.0 `(patch) <https://github.com/django/django/commit/6fffc3c6d420e44f4029d5643f38d00a39b08525>`__
* Django 1.11 `(patch) <https://github.com/django/django/commit/d6eaee092709aad477a9894598496c6deec532ff>`__
* Django 2.1 :commit:`(patch) <c4e5ff7fdb5fce447675e90291fd33fddd052b3c>`
* Django 2.0 :commit:`(patch) <6fffc3c6d420e44f4029d5643f38d00a39b08525>`
* Django 1.11 :commit:`(patch) <d6eaee092709aad477a9894598496c6deec532ff>`
October 1, 2018 - :cve:`2018-16984`
-----------------------------------
@ -908,7 +908,7 @@ Password hash disclosure to "view only" admin users. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 2.1 `(patch) <https://github.com/django/django/commit/c4bd5b597e0aa2432e4c867b86650f18af117851>`__
* Django 2.1 :commit:`(patch) <c4bd5b597e0aa2432e4c867b86650f18af117851>`
January 4, 2019 - :cve:`2019-3498`
----------------------------------
@ -919,6 +919,6 @@ Content spoofing possibility in the default 404 page. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
* Django 2.1 `(patch) <https://github.com/django/django/commit/64d2396e83aedba3fcc84ca40f23fbd22f0b9b5b>`__
* Django 2.0 `(patch) <https://github.com/django/django/commit/9f4ed7c94c62e21644ef5115e393ac426b886f2e>`__
* Django 1.11 `(patch) <https://github.com/django/django/commit/1cd00fcf52d089ef0fe03beabd05d59df8ea052a>`__
* Django 2.1 :commit:`(patch) <64d2396e83aedba3fcc84ca40f23fbd22f0b9b5b>`
* Django 2.0 :commit:`(patch) <9f4ed7c94c62e21644ef5115e393ac426b886f2e>`
* Django 1.11 :commit:`(patch) <1cd00fcf52d089ef0fe03beabd05d59df8ea052a>`