diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2024-07-10 20:30:12 +0200 |
|---|---|---|
| committer | Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> | 2024-08-06 08:51:22 +0200 |
| commit | bd807c0c25ab69361a4c08edcc1cf04d4652aa0a (patch) | |
| tree | b9aa620ad5a6c747ee4b9aae9aef0f18c479347b /docs | |
| parent | 0c1a8909164d8f2846322efb1143b72ad1616bd8 (diff) | |
[5.1.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget.
Thanks Seokchan Yoon for the report.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/4.2.15.txt | 7 | ||||
| -rw-r--r-- | docs/releases/5.0.8.txt | 7 |
2 files changed, 14 insertions, 0 deletions
diff --git a/docs/releases/4.2.15.txt b/docs/releases/4.2.15.txt index 91d6d385e3..1c6a1c7ede 100644 --- a/docs/releases/4.2.15.txt +++ b/docs/releases/4.2.15.txt @@ -23,6 +23,13 @@ CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html denial-of-service attack via very large inputs with a specific sequence of characters. +CVE-2024-41991: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` and ``AdminURLFieldWidget`` +======================================================================================================================= + +:tfilter:`urlize`, :tfilter:`urlizetrunc`, and ``AdminURLFieldWidget`` were +subject to a potential denial-of-service attack via certain inputs with a very +large number of Unicode characters. + Bugfixes ======== diff --git a/docs/releases/5.0.8.txt b/docs/releases/5.0.8.txt index 7de9bb9de1..2a0823d0ca 100644 --- a/docs/releases/5.0.8.txt +++ b/docs/releases/5.0.8.txt @@ -23,6 +23,13 @@ CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html denial-of-service attack via very large inputs with a specific sequence of characters. +CVE-2024-41991: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` and ``AdminURLFieldWidget`` +======================================================================================================================= + +:tfilter:`urlize`, :tfilter:`urlizetrunc`, and ``AdminURLFieldWidget`` were +subject to a potential denial-of-service attack via certain inputs with a very +large number of Unicode characters. + Bugfixes ======== |