diff options
| -rw-r--r-- | docs/releases/1.3.6.txt | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/docs/releases/1.3.6.txt b/docs/releases/1.3.6.txt index af17ad3bb0..d55199a882 100644 --- a/docs/releases/1.3.6.txt +++ b/docs/releases/1.3.6.txt @@ -39,12 +39,11 @@ XML deserialization ------------------- The XML parser in the Python standard library is vulnerable to a number of -denial-of-service attacks via external entities and entity expansion. Django -uses this parser for deserializing XML-formatted database fixtures. The fixture -deserializer is not intended for use with untrusted data, but in order to err -on the side of safety in Django 1.3.6 the XML deserializer refuses to parse an -XML document with a DTD (DOCTYPE definition), which closes off these attack -avenues. +attacks via external entities and entity expansion. Django uses this parser for +deserializing XML-formatted database fixtures. The fixture deserializer is not +intended for use with untrusted data, but in order to err on the side of safety +in Django 1.3.6 the XML deserializer refuses to parse an XML document with a +DTD (DOCTYPE definition), which closes off these attack avenues. These issues in the Python standard library are CVE-2013-1664 and CVE-2013-1665. More information available `from the Python security team`_. |