chango.git, branch 2.2.26 django http://cgit.adnoto.dev/chango.git/atom?h=2.2.26 2022-01-04T09:30:01Z 2.2.x] Bumped version for 2.2.26 release. 2022-01-04T09:30:01Z Carlton Gibson carlton.gibson@noumenal.es 2022-01-04T09:29:49Z urn:sha1:44e7cca62382f2535ed0f5d2842b433f0bd23a57 [2.2.x] Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem. 2022-01-04T09:20:31Z Florian Apolloner florian@apolloner.eu 2021-12-17T20:07:50Z urn:sha1:4cb35b384ceef52123fc66411a73c36a706825e1 Thanks to Dennis Brinkrolf for the report. [2.2.x] Fixed CVE-2021-45116 -- Fixed potential information disclosure in dictsort template filter. 2022-01-04T09:20:31Z Florian Apolloner florian@apolloner.eu 2021-12-27T13:53:18Z urn:sha1:c9f648ccfac5ab90fb2829a66da4f77e68c7f93a Thanks to Dennis Brinkrolf for the report. Co-authored-by: Adam Johnson <me@adamj.eu> [2.2.x] Fixed CVE-2021-45115 -- Prevented DoS vector in UserAttributeSimilarityValidator. 2022-01-04T09:20:31Z Florian Apolloner florian@apolloner.eu 2021-12-27T13:48:03Z urn:sha1:2135637fdd5ce994de110affef9e67dffdf77277 Thanks Chris Bailey for the report. Co-authored-by: Adam Johnson <me@adamj.eu> [2.2.x] Added stub release notes for 2.2.26 release. 2021-12-28T09:10:15Z Carlton Gibson carlton.gibson@noumenal.es 2021-12-27T13:42:14Z urn:sha1:03b733d8a8f5b5d8ca0a3cc32b7e6e6c046d95e2 [2.2.x] Refs #33365, Refs #30530 -- Doc'd re_path() behavior change in Django 2.2.25, 3.1.14, and 3.2.10. 2021-12-15T17:56:38Z Mariusz Felisiak felisiak.mariusz@gmail.com 2021-12-15T17:54:02Z urn:sha1:b87820668e7bd519dbc05f6ee46f551858fb1d6d Follow up to d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6. Backport of 5de12a369a7b2231e668e0460c551c504718dbf6 from main [2.2.x] Added CVE-2021-44420 to security archive. 2021-12-07T07:56:25Z Mariusz Felisiak felisiak.mariusz@gmail.com 2021-12-07T07:51:26Z urn:sha1:573e70ea48f11a09a27e3380a4612655b61500e2 Backport of 8747052411275d290b2152ffcb8dee11afbb82cd from main [2.2.x] Post-release version bump. 2021-12-07T06:05:38Z Mariusz Felisiak felisiak.mariusz@gmail.com 2021-12-07T06:05:38Z urn:sha1:8439938602afda8725f56a60a624dd0ba0114770 [2.2.x] Bumped version for 2.2.25 release. 2021-12-07T06:03:33Z Mariusz Felisiak felisiak.mariusz@gmail.com 2021-12-07T06:03:33Z urn:sha1:79d8dcefb2739176839fa76f8780aca5aa9b7101 [2.2.x] Fixed #30530, CVE-2021-44420 -- Fixed potential bypass of an upstream access control based on URL paths. 2021-12-07T06:02:14Z Florian Apolloner florian@apolloner.eu 2021-11-29T10:52:03Z urn:sha1:7cf7d74e8a754446eeb85cacf2fef1247e0cb6d7 Thanks Sjoerd Job Postmus and TengMA(@te3t123) for reports. Backport of d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6 from main.