From 05413afa8c18cdb978fcdf470e09f7a12b234a23 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Fri, 22 Jan 2021 12:23:18 +0100
Subject: Fixed CVE-2021-3281 -- Fixed potential directory-traversal via
 archive.extract().

Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews.

Thanks Wang Baohua for the report.
---
 docs/releases/2.2.18.txt | 15 +++++++++++++++
 docs/releases/3.0.12.txt | 15 +++++++++++++++
 docs/releases/3.1.6.txt  | 12 ++++++++++--
 docs/releases/index.txt  |  2 ++
 4 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100644 docs/releases/2.2.18.txt
 create mode 100644 docs/releases/3.0.12.txt

(limited to 'docs')

diff --git a/docs/releases/2.2.18.txt b/docs/releases/2.2.18.txt
new file mode 100644
index 0000000000..45df4fb83c
--- /dev/null
+++ b/docs/releases/2.2.18.txt
@@ -0,0 +1,15 @@
+===========================
+Django 2.2.18 release notes
+===========================
+
+*February 1, 2021*
+
+Django 2.2.18 fixes a security issue with severity "low" in 2.2.17.
+
+CVE-2021-3281: Potential directory-traversal via ``archive.extract()``
+======================================================================
+
+The ``django.utils.archive.extract()`` function, used by
+:option:`startapp --template` and :option:`startproject --template`, allowed
+directory-traversal via an archive with absolute paths or relative paths with
+dot segments.
diff --git a/docs/releases/3.0.12.txt b/docs/releases/3.0.12.txt
new file mode 100644
index 0000000000..20d9459fea
--- /dev/null
+++ b/docs/releases/3.0.12.txt
@@ -0,0 +1,15 @@
+===========================
+Django 3.0.12 release notes
+===========================
+
+*February 1, 2021*
+
+Django 3.0.12 fixes a security issue with severity "low" in 3.0.11.
+
+CVE-2021-3281: Potential directory-traversal via ``archive.extract()``
+======================================================================
+
+The ``django.utils.archive.extract()`` function, used by
+:option:`startapp --template` and :option:`startproject --template`, allowed
+directory-traversal via an archive with absolute paths or relative paths with
+dot segments.
diff --git a/docs/releases/3.1.6.txt b/docs/releases/3.1.6.txt
index 2d0a48616d..027d2f3b16 100644
--- a/docs/releases/3.1.6.txt
+++ b/docs/releases/3.1.6.txt
@@ -2,9 +2,17 @@
 Django 3.1.6 release notes
 ==========================
 
-*Expected February 1, 2021*
+*February 1, 2021*
 
-Django 3.1.6 fixes several bugs in 3.1.5.
+Django 3.1.6 fixes a security issue with severity "low" and a bug in 3.1.5.
+
+CVE-2021-3281: Potential directory-traversal via ``archive.extract()``
+======================================================================
+
+The ``django.utils.archive.extract()`` function, used by
+:option:`startapp --template` and :option:`startproject --template`, allowed
+directory-traversal via an archive with absolute paths or relative paths with
+dot segments.
 
 Bugfixes
 ========
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index 68733d9b24..32d4d71567 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -52,6 +52,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   3.0.12
    3.0.11
    3.0.10
    3.0.9
@@ -70,6 +71,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   2.2.18
    2.2.17
    2.2.16
    2.2.15
-- 
cgit v1.3