From ffcb0091783c637670afeee6faa616e912f23279 Mon Sep 17 00:00:00 2001 From: Jacob Kaplan-Moss Date: Wed, 14 May 2014 18:07:32 +0200 Subject: [PATCH] Added release notes for 1.4.13, 1.5.8. --- docs/releases/1.4.13.txt | 47 ++++++++++++++++++++++++++++++++++++++++ docs/releases/1.5.8.txt | 47 ++++++++++++++++++++++++++++++++++++++++ docs/releases/index.txt | 2 ++ 3 files changed, 96 insertions(+) create mode 100644 docs/releases/1.4.13.txt create mode 100644 docs/releases/1.5.8.txt diff --git a/docs/releases/1.4.13.txt b/docs/releases/1.4.13.txt new file mode 100644 index 0000000000..bcbe460af5 --- /dev/null +++ b/docs/releases/1.4.13.txt @@ -0,0 +1,47 @@ +========================== +Django 1.4.13 release notes +========================== + +*May 13, 2014* + +Django 1.4.13 fixes two security issues in 1.4.12. + + +Caches may incorrectly be allowed to store and serve private data +================================================================= +In certain situations, Django may allow caches to store private data +related to a particular session and then serve that data to requests +with a different session, or no session at all. This can both lead to +information disclosure, and can be a vector for cache poisoning. + +When using Django sessions, Django will set a ``Vary: Cookie`` header to +ensure caches do not serve cached data to requests from other sessions. +However, older versions of Internet Explorer (most likely only Internet +Explorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server +2003) are unable to handle the ``Vary`` header in combination with many content +types. Therefore, Django would remove the header if the request was made by +Internet Explorer. + +To remedy this, the special behaviour for these older Internet Explorer versions +has been removed, and the ``Vary`` header is no longer stripped from the response. +In addition, modifications to the ``Cache-Control`` header for all Internet Explorer +requests with a ``Content-Disposition`` header, have also been removed as they +were found to have similar issues. + + +Malformed redirect URLs from user input not correctly validated +=============================================================== +The validation for redirects did not correctly validate some malformed URLs, +which are accepted by some browsers. This allows a user to be redirected to +an unsafe URL unexpectedly. + +Django relies on user input in some cases (e.g. +:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and +:doc:`i18n `) to redirect the user to an "on success" URL. +The security checks for these redirects (namely +``django.util.http.is_safe_url()``) did not correctly validate some malformed +URLs, such as `http:\\\\\\djangoproject.com`, which are accepted by some browsers +with more liberal URL parsing. + +To remedy this, the validation in ``is_safe_url()`` has been tightened to be able +to handle and correctly validate these malformed URLs. diff --git a/docs/releases/1.5.8.txt b/docs/releases/1.5.8.txt new file mode 100644 index 0000000000..0fe3c95f62 --- /dev/null +++ b/docs/releases/1.5.8.txt @@ -0,0 +1,47 @@ +========================== +Django 1.5.8 release notes +========================== + +*May 13, 2014* + +Django 1.5.8 fixes two security issues in 1.5.8. + + +Caches may incorrectly be allowed to store and serve private data +================================================================= +In certain situations, Django may allow caches to store private data +related to a particular session and then serve that data to requests +with a different session, or no session at all. This can both lead to +information disclosure, and can be a vector for cache poisoning. + +When using Django sessions, Django will set a ``Vary: Cookie`` header to +ensure caches do not serve cached data to requests from other sessions. +However, older versions of Internet Explorer (most likely only Internet +Explorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server +2003) are unable to handle the ``Vary`` header in combination with many content +types. Therefore, Django would remove the header if the request was made by +Internet Explorer. + +To remedy this, the special behaviour for these older Internet Explorer versions +has been removed, and the ``Vary`` header is no longer stripped from the response. +In addition, modifications to the ``Cache-Control`` header for all Internet Explorer +requests with a ``Content-Disposition`` header, have also been removed as they +were found to have similar issues. + + +Malformed redirect URLs from user input not correctly validated +=============================================================== +The validation for redirects did not correctly validate some malformed URLs, +which are accepted by some browsers. This allows a user to be redirected to +an unsafe URL unexpectedly. + +Django relies on user input in some cases (e.g. +:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and +:doc:`i18n `) to redirect the user to an "on success" URL. +The security checks for these redirects (namely +``django.util.http.is_safe_url()``) did not correctly validate some malformed +URLs, such as `http:\\\\\\djangoproject.com`, which are accepted by some browsers +with more liberal URL parsing. + +To remedy this, the validation in ``is_safe_url()`` has been tightened to be able +to handle and correctly validate these malformed URLs. diff --git a/docs/releases/index.txt b/docs/releases/index.txt index 44e650892f..f6b50230d1 100644 --- a/docs/releases/index.txt +++ b/docs/releases/index.txt @@ -22,6 +22,7 @@ Final releases .. toctree:: :maxdepth: 1 + 1.5.8 1.5.7 1.5.6 1.5.5 @@ -36,6 +37,7 @@ Final releases .. toctree:: :maxdepth: 1 + 1.4.13 1.4.12 1.4.11 1.4.10