From 6d343d01c57eb03ca1c6826318b652709e58a76e Mon Sep 17 00:00:00 2001 From: Florian Apolloner Date: Fri, 17 Dec 2021 21:07:50 +0100 Subject: Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem. Thanks to Dennis Brinkrolf for the report. --- docs/releases/2.2.26.txt | 5 +++++ docs/releases/3.2.11.txt | 5 +++++ docs/releases/4.0.1.txt | 5 +++++ 3 files changed, 15 insertions(+) (limited to 'docs') diff --git a/docs/releases/2.2.26.txt b/docs/releases/2.2.26.txt index 2ed9b32119..9a53c51e27 100644 --- a/docs/releases/2.2.26.txt +++ b/docs/releases/2.2.26.txt @@ -33,6 +33,11 @@ resolution logic, that will not call methods, nor allow indexing on dictionaries. As a reminder, all untrusted user input should be validated before use. +CVE-2021-45452: Potential directory-traversal via ``Storage.save()`` +==================================================================== + +``Storage.save()`` allowed directory-traversal if directly passed suitably +crafted file names. This issue has severity "low" according to the :ref:`Django security policy `. diff --git a/docs/releases/3.2.11.txt b/docs/releases/3.2.11.txt index e715ae866f..adff2d6d08 100644 --- a/docs/releases/3.2.11.txt +++ b/docs/releases/3.2.11.txt @@ -33,6 +33,11 @@ resolution logic, that will not call methods, nor allow indexing on dictionaries. As a reminder, all untrusted user input should be validated before use. +CVE-2021-45452: Potential directory-traversal via ``Storage.save()`` +==================================================================== + +``Storage.save()`` allowed directory-traversal if directly passed suitably +crafted file names. This issue has severity "low" according to the :ref:`Django security policy `. diff --git a/docs/releases/4.0.1.txt b/docs/releases/4.0.1.txt index 5335511f1e..3128d20431 100644 --- a/docs/releases/4.0.1.txt +++ b/docs/releases/4.0.1.txt @@ -33,6 +33,11 @@ resolution logic, that will not call methods, nor allow indexing on dictionaries. As a reminder, all untrusted user input should be validated before use. +CVE-2021-45452: Potential directory-traversal via ``Storage.save()`` +==================================================================== + +``Storage.save()`` allowed directory-traversal if directly passed suitably +crafted file names. This issue has severity "low" according to the :ref:`Django security policy `. -- cgit v1.3