From b3e4494d759202a3b6bf247fd34455bf13be5b80 Mon Sep 17 00:00:00 2001 From: Carlton Gibson Date: Wed, 27 Jul 2022 10:27:42 +0200 Subject: [3.2.x] Fixed CVE-2022-36359 -- Escaped filename in Content-Disposition header. Thanks to Motoyasu Saburi for the report. --- docs/releases/3.2.15.txt | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'docs') diff --git a/docs/releases/3.2.15.txt b/docs/releases/3.2.15.txt index a7a56ae965..281444ecf2 100644 --- a/docs/releases/3.2.15.txt +++ b/docs/releases/3.2.15.txt @@ -6,4 +6,10 @@ Django 3.2.15 release notes Django 3.2.15 fixes a security issue with severity "high" in 3.2.14. -... +CVE-2022-36359: Potential reflected file download vulnerability in ``FileResponse`` +=================================================================================== + +An application may have been vulnerable to a reflected file download (RFD) +attack that sets the Content-Disposition header of a +:class:`~django.http.FileResponse` when the ``filename`` was derived from +user-supplied input. The ``filename`` is now escaped to avoid this possibility. -- cgit v1.3