innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity
27,062 Commits 25 Branches 361 Tags 501 MiB
Commit Graph

3358 Commits

Author SHA1 Message Date
Mariusz Felisiak 2a62cdcfec [2.2.x] Added CVE-2022-28346 and CVE-2022-28347 to security archive. 
Backport of 78eeff8d33 from main
 2022-04-11 10:37:53 +02:00
Mariusz Felisiak 29a6c98b4c [2.2.x] Fixed CVE-2022-28347 -- Protected QuerySet.explain(**options) against SQL injection on PostgreSQL. 
Backport of 6723a26e59 from main.
 2022-04-11 09:23:12 +02:00
Mariusz Felisiak 2c09e68ec9 [2.2.x] Fixed CVE-2022-28346 -- Protected QuerySet.annotate(), aggregate(), and extra() against SQL injection in column aliases. 
Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore,
Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev
(DDV_UA) for the report.

Backport of 93cae5cb2f from main.
 2022-04-11 09:22:17 +02:00
Mariusz Felisiak 8352b98e46 [2.2.x] Added stub release notes for 2.2.28. 
Backport of 78277faafd from main
 2022-04-04 10:55:50 +02:00
David Smith 9d13d8c10b [2.2.x] Fixed typo in release notes. 
Backport of 770d3e6a4c from main.
 2022-02-02 07:20:28 +01:00
Mariusz Felisiak 047ece3014 [2.2.x] Added CVE-2022-22818 and CVE-2022-23833 to security archive. 
Backport of 9e0df0d6dd from main
 2022-02-01 08:54:34 +01:00
Mariusz Felisiak c477b76180 [2.2.x] Fixed CVE-2022-23833 -- Fixed DoS possiblity in file uploads. 
Thanks Alan Ryan for the report and initial patch.

Backport of fc18f36c4a from main.
 2022-02-01 07:57:28 +01:00
Markus Holtermann c27a7eb9f4 [2.2.x] Fixed CVE-2022-22818 -- Fixed possible XSS via {% debug %} template tag. 
Thanks Keryn Knight for the report.

Backport of 394517f078 from main.

Co-authored-by: Adam Johnson <me@adamj.eu>
 2022-02-01 07:56:29 +01:00
Mariusz Felisiak 4cafd3aacb [2.2.x] Added stub release notes 2.2.27. 
Backport of eeca934238 from main.
 2022-01-25 07:29:28 +01:00
Carlton Gibson 77d0fe5868 [2.2.x] Added CVE-2021-45115, CVE-2021-45116, and CVE-2021-45452 to security archive. 
Backport of 63869ab1f1 from main
 2022-01-04 11:39:54 +01:00
Florian Apolloner 4cb35b384c [2.2.x] Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem. 
Thanks to Dennis Brinkrolf for the report.
 2022-01-04 10:20:31 +01:00
Florian Apolloner c9f648ccfa [2.2.x] Fixed CVE-2021-45116 -- Fixed potential information disclosure in dictsort template filter. 
Thanks to Dennis Brinkrolf for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
 2022-01-04 10:20:31 +01:00
Florian Apolloner 2135637fdd [2.2.x] Fixed CVE-2021-45115 -- Prevented DoS vector in UserAttributeSimilarityValidator. 
Thanks Chris Bailey for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
 2022-01-04 10:20:31 +01:00
Carlton Gibson 03b733d8a8 [2.2.x] Added stub release notes for 2.2.26 release. 2021-12-28 10:10:15 +01:00
Mariusz Felisiak 573e70ea48 [2.2.x] Added CVE-2021-44420 to security archive. 
Backport of 8747052411 from main
 2021-12-07 08:56:25 +01:00
Florian Apolloner 7cf7d74e8a [2.2.x] Fixed #30530, CVE-2021-44420 -- Fixed potential bypass of an upstream access control based on URL paths. 
Thanks Sjoerd Job Postmus and TengMA(@te3t123) for reports.

Backport of d4dcd5b9dd from main.
 2021-12-07 07:02:14 +01:00
Mariusz Felisiak fac0fdd95d [2.2.x] Added stub release notes for 2.2.25. 
Backport of ae4077e13e from main.
 2021-11-30 11:31:56 +01:00
Mariusz Felisiak dc43667eab [2.2.x] Fixed docs header underlines in security archive. 
Backport of d9cee3f5f2 from main
 2021-06-02 12:29:11 +02:00
Carlton Gibson 3e7bb564be [2.2.x] Added CVE-2021-33203 and CVE-2021-33571 to security archive. 
Backport of a39f235ca4 from main
 2021-06-02 11:19:59 +02:00
Mariusz Felisiak f27c38ab5d [2.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses. 
validate_ipv4_address() was affected only on Python < 3.9.5, see [1].
URLValidator() uses a regular expressions and it was affected on all
Python versions.

[1] https://bugs.python.org/issue36384
 2021-06-02 10:26:22 +02:00
Florian Apolloner 053cc9534d [2.2.x] Fixed CVE-2021-33203 -- Fixed potential path-traversal via admindocs' TemplateDetailView. 2021-06-02 10:26:22 +02:00
Carlton Gibson 6229d8794f [2.2.x] Confirmed release date for Django 2.2.24. 
Backport of f66ae7a2d5 from main.
 2021-06-02 10:23:20 +02:00
Carlton Gibson f163ad5c63 [2.2.x] Added stub release notes and date for Django 2.2.24. 
Backport of b46dbd4e3e from main
 2021-05-26 10:21:53 +02:00
Mariusz Felisiak bed1755bc5 [2.2.x] Changed IRC references to Libera.Chat. 
Backport of 66491f08fe from main.
 2021-05-20 12:42:48 +02:00
Mariusz Felisiak b8ecb06436 [2.2.x] Fixed #32718 -- Relaxed file name validation in FileField. 
- Validate filename returned by FileField.upload_to() not a filename
  passed to the FileField.generate_filename() (upload_to() may
  completely ignored passed filename).
- Allow relative paths (without dot segments) in the generated filename.

Thanks to Jakub Kleň for the report and review.
Thanks to all folks for checking this patch on existing projects.
Thanks Florian Apolloner and Markus Holtermann for the discussion and
implementation idea.

Regression in 0b79eb3691.

Backport of b55699968f from main.
 2021-05-13 09:00:25 +02:00
Mariusz Felisiak 3ba089ac7e [2.2.x] Refs #32718 -- Corrected CVE-2021-31542 release notes. 
Backport of d1f1417cae from main.
 2021-05-12 10:44:25 +02:00
Mariusz Felisiak 88d9b28c0c [2.2.x] Added CVE-2021-32052 to security archive. 
Backport of efebcc429f from main
 2021-05-06 10:05:46 +02:00
Mariusz Felisiak d9594c4ea5 [2.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+. 
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603

Backport of e1e81aa1c4 from main.
 2021-05-06 08:53:27 +02:00
Carlton Gibson bcafd9ba84 [2.2.x] Added CVE-2021-31542 to security archive. 
Backport of 607ebbfba9 and
62b2e8b37e from main
 2021-05-04 11:14:17 +02:00
Florian Apolloner 04ac1624bd [2.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-04-27 19:10:08 +02:00
Mariusz Felisiak 7f1b088ab4 [2.2.x] Added CVE-2021-28658 to security archive. 
Backport of 1eac8468cb from main
 2021-04-06 09:48:05 +02:00
Mariusz Felisiak 4036d62bda [2.2.x] Fixed CVE-2021-28658 -- Fixed potential directory-traversal via uploaded files. 
Thanks Claude Paroz for the initial patch.
Thanks Dennis Brinkrolf for the report.

Backport of d4d800ca1a from main.
 2021-04-06 08:38:19 +02:00
Carlton Gibson 6e58828f8b [2.2.x] Added CVE-2021-23336 to security archive. 
Backport of ab58f07250 from master
 2021-02-19 11:07:56 +01:00
Nick Pope fd6b6afd59 [2.2.x] Fixed CVE-2021-23336 -- Fixed web cache poisoning via django.utils.http.limited_parse_qsl(). 2021-02-18 10:27:25 +01:00
Nick Pope 226d831918 [2.2.x] Added documentation extlink for bugs.python.org. 
Backport of d02d60eb0f from master
 2021-02-17 14:28:05 +01:00
Mariusz Felisiak 34010d8ffa [2.2.x] Added CVE-2021-3281 to security archive. 
Backport of f749148d62 from master
 2021-02-01 10:47:08 +01:00
Mariusz Felisiak 21e7622dec [2.2.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal via archive.extract(). 
Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews.

Thanks Wang Baohua for the report.

Backport of 05413afa8c from master.
 2021-02-01 09:14:54 +01:00
Carlton Gibson 3db9a7aa8b [2.2.x] Set release date for 2.2.17. 
Backport of 7fc07b9b2b from master
 2020-11-02 08:39:12 +01:00
Mariusz Felisiak b4b8ca4895 [2.2.x] Refs #31040 -- Doc'd Python 3.9 compatibility. 
Backport of e18156b6c3 from master.
 2020-10-13 08:45:37 +02:00
Carlton Gibson 0f6e73e567 [2.2.x] Added CVE-2020-24583 & CVE-2020-24584 to security archive. 
Backport of d5b526bf78 from master
 2020-09-01 11:39:59 +02:00
Carlton Gibson 65078cf060 [2.2.x] Added CVE-2020-13254 and CVE-2020-13596 to security archive. 
Backport of 54975780ee from master
 2020-09-01 11:39:57 +02:00
Carlton Gibson dfcecb6e6c [2.2.x] Added release date for 2.2.16. 
Backport of 976e2b7420 from master
 2020-09-01 10:00:28 +02:00
Mariusz Felisiak a3aebfdc81 [2.2.x] Fixed CVE-2020-24584 -- Fixed permission escalation in intermediate-level directories of the file system cache on Python 3.7+. 
Backport of f56b57976133129b0b351a38bba4ac882badabf0 from master.
 2020-08-25 11:09:40 +02:00
Mariusz Felisiak 375657a71c [2.2.x] Fixed CVE-2020-24583, #31921 -- Fixed permissions on intermediate-level static and storage directories on Python 3.7+. 
Thanks WhiteSage for the report.

Backport of ea0febbba531a3ecc8c77b570efbfb68ca7155db from master.
 2020-08-25 10:59:42 +02:00
Mariusz Felisiak dc39e62e6b [2.2.x] Refs #31863 -- Added release notes for 94ea79be13. 
Backport of 21768a99f4 from master
 2020-08-13 16:32:58 +02:00
Daniel Hillier 839f906a23 [2.2.x] Fixed #31866 -- Fixed locking proxy models in QuerySet.select_for_update(of=()). 
Backport of 60626162f7 from master
 2020-08-11 12:33:18 +02:00
Mariusz Felisiak 30706246e7 [2.2.x] Added stub release notes for 2.2.16. 
Backport of 8a5683b6b2 from master
 2020-08-11 11:14:35 +02:00
Mariusz Felisiak b70595c94c [2.2.x] Added release date for 2.2.15. 
Backport of b68b8cb89a from master
 2020-08-03 08:58:00 +02:00
Florian Apolloner 1a3835fdf3 [2.2.x] Fixed #31784 -- Fixed crash when sending emails on Python 3.6.11+, 3.7.8+, and 3.8.4+. 
Fixed sending emails crash on email addresses with display names longer
then 75 chars on Python 3.6.11+, 3.7.8+, and 3.8.4+.

Wrapped display names were passed to email.headerregistry.Address()
what caused raising an exception because address parts cannot contain
CR or LF.

See https://bugs.python.org/issue39073

Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>

Backport of 96a3ea39ef from master.
 2020-07-20 08:11:30 +02:00
Mariusz Felisiak f1a6e6c817 [2.2.x] Fixed #31790 -- Fixed setting SameSite cookies flag in HttpResponse.delete_cookie(). 
Cookies with the "SameSite" flag set to None and without the "secure"
flag will be soon rejected by latest browser versions.

This affects sessions and messages cookies.

Backport of 331324ecce from stable/3.0.x
 2020-07-16 09:35:35 +02:00