From d4d800ca1addc4141e03c5440a849bb64d1582cd Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Tue, 16 Mar 2021 10:19:00 +0100
Subject: Fixed CVE-2021-28658 -- Fixed potential directory-traversal via
 uploaded files.

Thanks Claude Paroz for the initial patch.
Thanks Dennis Brinkrolf for the report.
---
 docs/releases/2.2.20.txt | 15 +++++++++++++++
 docs/releases/3.0.14.txt | 15 +++++++++++++++
 docs/releases/3.1.8.txt  | 12 ++++++++++--
 docs/releases/index.txt  |  2 ++
 4 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100644 docs/releases/2.2.20.txt
 create mode 100644 docs/releases/3.0.14.txt

(limited to 'docs')

diff --git a/docs/releases/2.2.20.txt b/docs/releases/2.2.20.txt
new file mode 100644
index 0000000000..a67c515021
--- /dev/null
+++ b/docs/releases/2.2.20.txt
@@ -0,0 +1,15 @@
+===========================
+Django 2.2.20 release notes
+===========================
+
+*April 6, 2021*
+
+Django 2.2.20 fixes a security issue with severity "low" in 2.2.19.
+
+CVE-2021-28658: Potential directory-traversal via uploaded files
+================================================================
+
+``MultiPartParser`` allowed directory-traversal via uploaded files with
+suitably crafted file names.
+
+Built-in upload handlers were not affected by this vulnerability.
diff --git a/docs/releases/3.0.14.txt b/docs/releases/3.0.14.txt
new file mode 100644
index 0000000000..c324428745
--- /dev/null
+++ b/docs/releases/3.0.14.txt
@@ -0,0 +1,15 @@
+===========================
+Django 3.0.14 release notes
+===========================
+
+*April 6, 2021*
+
+Django 3.0.14 fixes a security issue with severity "low" in 3.0.13.
+
+CVE-2021-28658: Potential directory-traversal via uploaded files
+================================================================
+
+``MultiPartParser`` allowed directory-traversal via uploaded files with
+suitably crafted file names.
+
+Built-in upload handlers were not affected by this vulnerability.
diff --git a/docs/releases/3.1.8.txt b/docs/releases/3.1.8.txt
index d166a1200c..cf04b89c36 100644
--- a/docs/releases/3.1.8.txt
+++ b/docs/releases/3.1.8.txt
@@ -2,9 +2,17 @@
 Django 3.1.8 release notes
 ==========================
 
-*Expected April 5, 2021*
+*April 6, 2021*
 
-Django 3.1.8 fixes several bugs in 3.1.7.
+Django 3.1.8 fixes a security issue with severity "low" and a bug in 3.1.7.
+
+CVE-2021-28658: Potential directory-traversal via uploaded files
+================================================================
+
+``MultiPartParser`` allowed directory-traversal via uploaded files with
+suitably crafted file names.
+
+Built-in upload handlers were not affected by this vulnerability.
 
 Bugfixes
 ========
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index e17624d21e..f48505d25b 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -54,6 +54,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   3.0.14
    3.0.13
    3.0.12
    3.0.11
@@ -74,6 +75,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   2.2.20
    2.2.19
    2.2.18
    2.2.17
-- 
cgit v1.3