diff --git a/docs/internals/howto-release-django.txt b/docs/internals/howto-release-django.txt index 97f3ae0823..0f7ca88c50 100644 --- a/docs/internals/howto-release-django.txt +++ b/docs/internals/howto-release-django.txt @@ -87,7 +87,8 @@ any time leading up to the actual release: the release. We maintain a list of who gets these pre-notification emails in the private ``django-core`` repository. This email should be signed by the key you'll use for the release, and should include patches for each issue - being fixed. + being fixed. Also make sure to update the security issues archive; this will + be in ``docs/releases/security.txt``. #. If this is a major release, make sure the tests pass, then increase the default PBKDF2 iterations in diff --git a/docs/releases/security.txt b/docs/releases/security.txt index c73cea6dbd..d48d0b4dc3 100644 --- a/docs/releases/security.txt +++ b/docs/releases/security.txt @@ -450,10 +450,10 @@ Versions affected * Django 1.5 `(patch) `__ -April 21, 2014 - CVE-2014-2014-0472 -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +April 21, 2014 - CVE-2014-0472 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -`CVE-2014-0472 `_: Unexpected code execution using ``reverse()``. `Full description `_ +`CVE-2014-0472 `_: Unexpected code execution using ``reverse()``. `Full description `__ Versions affected ----------------- @@ -467,10 +467,10 @@ Versions affected * Django 1.7 `(patch) `__ -April 21, 2014 - CVE-2014-2014-0473 -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +April 21, 2014 - CVE-2014-0473 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -`CVE-2014-0473 `_: Caching of anonymous pages could reveal CSRF token. `Full description `_ +`CVE-2014-0473 `_: Caching of anonymous pages could reveal CSRF token. `Full description `__ Versions affected ----------------- @@ -484,10 +484,10 @@ Versions affected * Django 1.7 `(patch) `__ -April 21, 2014 - CVE-2014-2014-0474 -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +April 21, 2014 - CVE-2014-0474 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -`CVE-2014-0474 `_: MySQL typecasting causes unexpected query results. `Full description `_ +`CVE-2014-0474 `_: MySQL typecasting causes unexpected query results. `Full description `__ Versions affected ----------------- @@ -499,3 +499,105 @@ Versions affected * Django 1.6 `(patch) `__ * Django 1.7 `(patch) `__ + + +May 18, 2014 - CVE-2014-1418 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +`CVE-2014-1418 `_: Caches may be allowed to store and serve private data. `Full description `__ + +Versions affected +----------------- + +* Django 1.4 `(patch) `__ + +* Django 1.5 `(patch) `__ + +* Django 1.6 `(patch) `__ + +* Django 1.7 `(patch) `__ + + +May 18, 2014 - CVE-2014-3730 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +`CVE-2014-3730 `_: Malformed URLs from user input incorrectly validated. `Full description `__ + +Versions affected +----------------- + +* Django 1.4 `(patch) `__ + +* Django 1.5 `(patch) `__ + +* Django 1.6 `(patch) `__ + +* Django 1.7 `(patch) `__ + + +August 20, 2014 - CVE-2014-0480 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +`CVE-2014-0480 `_: reverse() can generate URLs pointing to other hosts. `Full description `__ + +Versions affected +----------------- + +* Django 1.4 `(patch) `__ + +* Django 1.5 `(patch) `__ + +* Django 1.6 `(patch) `__ + +* Django 1.7 `(patch) `__ + + +August 20, 2014 - CVE-2014-0481 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +`CVE-2014-0481 `_: File upload denial of service. `Full description `__ + +Versions affected +----------------- + +* Django 1.4 `(patch) `__ + +* Django 1.5 `(patch) `__ + +* Django 1.6 `(patch) `__ + +* Django 1.7 `(patch) `__ + + +August 20, 2014 - CVE-2014-0482 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +`CVE-2014-0482 `_: RemoteUserMiddleware session hijacking. `Full description `__ + +Versions affected +----------------- + +* Django 1.4 `(patch) `__ + +* Django 1.5 `(patch) `__ + +* Django 1.6 `(patch) `__ + +* Django 1.7 `(patch) `__ + + +August 20, 2014 - CVE-2014-0483 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +`CVE-2014-0483 `_: Data leakage via querystring manipulation in admin. `Full description `__ + +Versions affected +----------------- + +* Django 1.4 `(patch) `__ + +* Django 1.5 `(patch) `__ + +* Django 1.6 `(patch) `__ + +* Django 1.7 `(patch) `__