chango.git, branch 3.2.11 django http://cgit.adnoto.dev/chango.git/atom?h=3.2.11 2022-01-04T09:36:54Z [3.2.x] Bumped version for 3.2.11 release. 2022-01-04T09:36:54Z Carlton Gibson carlton.gibson@noumenal.es 2022-01-04T09:36:54Z urn:sha1:6e499a28ac6ec10c2f0f77b92cab49fb8f8df419 [3.2.x] Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem. 2022-01-04T09:19:49Z Florian Apolloner florian@apolloner.eu 2021-12-17T20:07:50Z urn:sha1:8d2f7cff76200cbd2337b2cf1707e383eb1fb54b Thanks to Dennis Brinkrolf for the report. [3.2.x] Fixed CVE-2021-45116 -- Fixed potential information disclosure in dictsort template filter. 2022-01-04T09:19:49Z Florian Apolloner florian@apolloner.eu 2021-12-27T13:53:18Z urn:sha1:c7fe895bca06daf12cc1670b56eaf72a1ef27a16 Thanks to Dennis Brinkrolf for the report. Co-authored-by: Adam Johnson <me@adamj.eu> [3.2.x] Fixed CVE-2021-45115 -- Prevented DoS vector in UserAttributeSimilarityValidator. 2022-01-04T09:19:49Z Florian Apolloner florian@apolloner.eu 2021-12-27T13:48:03Z urn:sha1:a8b32fe13bcaed1c0b772fdc53de84abc224fb20 Thanks Chris Bailey for the report. Co-authored-by: Adam Johnson <me@adamj.eu> [3.2.x] Added stub release notes for 3.2.11, and 2.2.26 releases. 2021-12-28T09:09:49Z Carlton Gibson carlton.gibson@noumenal.es 2021-12-27T13:42:14Z urn:sha1:b0aa0709a58b9523a7a0b78088bf81c23053eba0 Backport of b13d920b7b56d3e088e35311f5ee54f25d2779af from main. [3.2.x] Refs #33365, Refs #30530 -- Doc'd re_path() behavior change in Django 2.2.25, 3.1.14, and 3.2.10. 2021-12-15T17:55:01Z Mariusz Felisiak felisiak.mariusz@gmail.com 2021-12-15T17:54:02Z urn:sha1:ae242235db910a94ea476b7a3efacf8dbab31c4f Follow up to d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6. Backport of 5de12a369a7b2231e668e0460c551c504718dbf6 from main [3.2.x] Added CVE-2021-44420 to security archive. 2021-12-07T07:54:16Z Mariusz Felisiak felisiak.mariusz@gmail.com 2021-12-07T07:51:26Z urn:sha1:ecd27938972bfc48bbfeaa642d5906ccc8c6d6e2 Backport of 8747052411275d290b2152ffcb8dee11afbb82cd from main [3.2.x] Post-release version bump. 2021-12-07T05:53:39Z Mariusz Felisiak felisiak.mariusz@gmail.com 2021-12-07T05:53:39Z urn:sha1:1cea03ab00551d3a5d9f359777129676dfa4ab26 [3.2.x] Bumped version for 3.2.10 release. 2021-12-07T05:34:51Z Mariusz Felisiak felisiak.mariusz@gmail.com 2021-12-07T05:34:51Z urn:sha1:0153a63a674937e4a56d9d5e4ca2d629b011fbde [3.2.x] Fixed #30530, CVE-2021-44420 -- Fixed potential bypass of an upstream access control based on URL paths. 2021-12-07T05:32:24Z Florian Apolloner florian@apolloner.eu 2021-11-29T10:52:03Z urn:sha1:333c65603032c377e682cdbd7388657a5463a05a Thanks Sjoerd Job Postmus and TengMA(@te3t123) for reports. Backport of d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6 from main.