[1.4.x] Don't characterize XML vulnerabilities as DoS-only.

1 files changed, 5 insertions, 6 deletions

diff --git a/docs/releases/1.4.4.txt b/docs/releases/1.4.4.txt
index cdbf159b79..c5fcbc3e39 100644
--- a/docs/releases/1.4.4.txt
+++ b/docs/releases/1.4.4.txt
@@ -40,12 +40,11 @@ XML deserialization
 -------------------
 
 The XML parser in the Python standard library is vulnerable to a number of
-denial-of-service attacks via external entities and entity expansion. Django
-uses this parser for deserializing XML-formatted database fixtures. This
-deserializer is not intended for use with untrusted data, but in order to err
-on the side of safety in Django 1.4.4 the XML deserializer refuses to parse an
-XML document with a DTD (DOCTYPE definition), which closes off these attack
-avenues.
+attacks via external entities and entity expansion. Django uses this parser for
+deserializing XML-formatted database fixtures. This deserializer is not
+intended for use with untrusted data, but in order to err on the side of safety
+in Django 1.4.4 the XML deserializer refuses to parse an XML document with a
+DTD (DOCTYPE definition), which closes off these attack avenues.
 
 These issues in the Python standard library are CVE-2013-1664 and
 CVE-2013-1665. More information available `from the Python security team`_.