diff options
| author | Adam Johnson <me@adamj.eu> | 2024-06-24 15:30:59 +0200 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2024-07-09 09:21:19 -0300 |
| commit | d6664574539c1531612dea833d264ed5c2b04e1e (patch) | |
| tree | 2a65e02a92e7b2022fe32090b4d1620b50f5e322 /docs | |
| parent | af84bcc8d1b129bd2dc35fae6bb42a175143661f (diff) | |
Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters.
Thank you to Elias Myllymäki for the report.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/4.2.14.txt | 6 | ||||
| -rw-r--r-- | docs/releases/5.0.7.txt | 7 |
2 files changed, 13 insertions, 0 deletions
diff --git a/docs/releases/4.2.14.txt b/docs/releases/4.2.14.txt index a0d95a477b..f32c0cf8d4 100644 --- a/docs/releases/4.2.14.txt +++ b/docs/releases/4.2.14.txt @@ -7,3 +7,9 @@ Django 4.2.14 release notes Django 4.2.14 fixes two security issues with severity "moderate" and two security issues with severity "low" in 4.2.13. +CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via certain inputs with a very large number of +brackets. diff --git a/docs/releases/5.0.7.txt b/docs/releases/5.0.7.txt index 0bee6d57ce..f25bc1f37d 100644 --- a/docs/releases/5.0.7.txt +++ b/docs/releases/5.0.7.txt @@ -7,6 +7,13 @@ Django 5.0.7 release notes Django 5.0.7 fixes two security issues with severity "moderate", two security issues with severity "low", and several bugs in 5.0.6. +CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via certain inputs with a very large number of +brackets. + Bugfixes ======== |