From 7285644640f085f41d60ab0c8ae4e9153f0485db Mon Sep 17 00:00:00 2001 From: Adam Johnson Date: Mon, 24 Jun 2024 15:30:59 +0200 Subject: [5.0.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thank you to Elias Myllymäki for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> --- docs/releases/4.2.14.txt | 6 ++++++ docs/releases/5.0.7.txt | 7 +++++++ 2 files changed, 13 insertions(+) (limited to 'docs') diff --git a/docs/releases/4.2.14.txt b/docs/releases/4.2.14.txt index a0d95a477b..f32c0cf8d4 100644 --- a/docs/releases/4.2.14.txt +++ b/docs/releases/4.2.14.txt @@ -7,3 +7,9 @@ Django 4.2.14 release notes Django 4.2.14 fixes two security issues with severity "moderate" and two security issues with severity "low" in 4.2.13. +CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via certain inputs with a very large number of +brackets. diff --git a/docs/releases/5.0.7.txt b/docs/releases/5.0.7.txt index 0bee6d57ce..f25bc1f37d 100644 --- a/docs/releases/5.0.7.txt +++ b/docs/releases/5.0.7.txt @@ -7,6 +7,13 @@ Django 5.0.7 release notes Django 5.0.7 fixes two security issues with severity "moderate", two security issues with severity "low", and several bugs in 5.0.6. +CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via certain inputs with a very large number of +brackets. + Bugfixes ======== -- cgit v1.3