diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2021-12-17 21:07:50 +0100 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2022-01-04 10:10:14 +0100 |
| commit | e1592e0f26302e79856cc7f2218ae848ae19b0f6 (patch) | |
| tree | 21734ca3f279023fecbfd10a9ea31cfa8aebf8a8 /docs | |
| parent | 2a8ec7f546d6d5806e221ec948c5146b55bd7489 (diff) | |
[4.0.x] Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem.
Thanks to Dennis Brinkrolf for the report.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/2.2.26.txt | 9 | ||||
| -rw-r--r-- | docs/releases/3.2.11.txt | 9 | ||||
| -rw-r--r-- | docs/releases/4.0.1.txt | 9 |
3 files changed, 27 insertions, 0 deletions
diff --git a/docs/releases/2.2.26.txt b/docs/releases/2.2.26.txt index 2ed9b32119..7fbdc02089 100644 --- a/docs/releases/2.2.26.txt +++ b/docs/releases/2.2.26.txt @@ -36,3 +36,12 @@ As a reminder, all untrusted user input should be validated before use. This issue has severity "low" according to the :ref:`Django security policy <security-disclosure>`. + +CVE-2021-45452: Potential directory-traversal via ``Storage.save()`` +==================================================================== + +``Storage.save()`` allowed directory-traversal if directly passed suitably +crafted file names. + +This issue has severity "low" according to the :ref:`Django security policy +<security-disclosure>`. diff --git a/docs/releases/3.2.11.txt b/docs/releases/3.2.11.txt index e715ae866f..bb68e14a8e 100644 --- a/docs/releases/3.2.11.txt +++ b/docs/releases/3.2.11.txt @@ -36,3 +36,12 @@ As a reminder, all untrusted user input should be validated before use. This issue has severity "low" according to the :ref:`Django security policy <security-disclosure>`. + +CVE-2021-45452: Potential directory-traversal via ``Storage.save()`` +==================================================================== + +``Storage.save()`` allowed directory-traversal if directly passed suitably +crafted file names. + +This issue has severity "low" according to the :ref:`Django security policy +<security-disclosure>`. diff --git a/docs/releases/4.0.1.txt b/docs/releases/4.0.1.txt index 5335511f1e..d5e129a153 100644 --- a/docs/releases/4.0.1.txt +++ b/docs/releases/4.0.1.txt @@ -37,6 +37,15 @@ As a reminder, all untrusted user input should be validated before use. This issue has severity "low" according to the :ref:`Django security policy <security-disclosure>`. +CVE-2021-45452: Potential directory-traversal via ``Storage.save()`` +==================================================================== + +``Storage.save()`` allowed directory-traversal if directly passed suitably +crafted file names. + +This issue has severity "low" according to the :ref:`Django security policy +<security-disclosure>`. + Bugfixes ======== |