diff options
| author | Adam Johnson <me@adamj.eu> | 2024-06-24 15:30:59 +0200 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2024-07-09 10:03:07 -0300 |
| commit | 7285644640f085f41d60ab0c8ae4e9153f0485db (patch) | |
| tree | 708c59c7b786b5a5130c6e22176f89240818a14b /docs | |
| parent | 830340037b1bc499612752b835c1629d3aa01036 (diff) | |
[5.0.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters.
Thank you to Elias Myllymäki for the report.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/4.2.14.txt | 6 | ||||
| -rw-r--r-- | docs/releases/5.0.7.txt | 7 |
2 files changed, 13 insertions, 0 deletions
diff --git a/docs/releases/4.2.14.txt b/docs/releases/4.2.14.txt index a0d95a477b..f32c0cf8d4 100644 --- a/docs/releases/4.2.14.txt +++ b/docs/releases/4.2.14.txt @@ -7,3 +7,9 @@ Django 4.2.14 release notes Django 4.2.14 fixes two security issues with severity "moderate" and two security issues with severity "low" in 4.2.13. +CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via certain inputs with a very large number of +brackets. diff --git a/docs/releases/5.0.7.txt b/docs/releases/5.0.7.txt index 0bee6d57ce..f25bc1f37d 100644 --- a/docs/releases/5.0.7.txt +++ b/docs/releases/5.0.7.txt @@ -7,6 +7,13 @@ Django 5.0.7 release notes Django 5.0.7 fixes two security issues with severity "moderate", two security issues with severity "low", and several bugs in 5.0.6. +CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via certain inputs with a very large number of +brackets. + Bugfixes ======== |