diff options
| author | Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> | 2024-07-18 13:19:34 +0200 |
|---|---|---|
| committer | Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> | 2024-08-06 08:50:08 +0200 |
| commit | ecf1f8fb900f94de08c945164633e9a28a2edadb (patch) | |
| tree | ed2e0f3dd427187f435d6de1624fb71bb0403527 /docs | |
| parent | c19465ad87e33b6122c886b97a202ad54cd43672 (diff) | |
Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters.
Thanks to MProgrammer for the report.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/4.2.15.txt | 7 | ||||
| -rw-r--r-- | docs/releases/5.0.8.txt | 7 |
2 files changed, 14 insertions, 0 deletions
diff --git a/docs/releases/4.2.15.txt b/docs/releases/4.2.15.txt index f3fdb0a3cf..91d6d385e3 100644 --- a/docs/releases/4.2.15.txt +++ b/docs/releases/4.2.15.txt @@ -16,6 +16,13 @@ consumption. To avoid this, decimals with more than 200 digits are now returned as is. +CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via very large inputs with a specific sequence of +characters. + Bugfixes ======== diff --git a/docs/releases/5.0.8.txt b/docs/releases/5.0.8.txt index c371e4af0b..7de9bb9de1 100644 --- a/docs/releases/5.0.8.txt +++ b/docs/releases/5.0.8.txt @@ -16,6 +16,13 @@ consumption. To avoid this, decimals with more than 200 digits are now returned as is. +CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via very large inputs with a specific sequence of +characters. + Bugfixes ======== |