diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2021-06-18 01:16:10 -0400 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2021-07-01 09:42:54 +0200 |
| commit | dae83a24519d6f284c74414e0b81d64d9b5a0db4 (patch) | |
| tree | 61c297b6c432776d29a3ab54f5eb171bf31adfff /docs/releases/3.2.5.txt | |
| parent | 62988afbea7c7ea6ea7eb76382b3a87a5ccf310c (diff) | |
Forwardported release notes for CVE-2021-35042.
Diffstat (limited to 'docs/releases/3.2.5.txt')
| -rw-r--r-- | docs/releases/3.2.5.txt | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/docs/releases/3.2.5.txt b/docs/releases/3.2.5.txt index 9cc49e0ea1..533ecec4dd 100644 --- a/docs/releases/3.2.5.txt +++ b/docs/releases/3.2.5.txt @@ -4,8 +4,22 @@ Django 3.2.5 release notes *July 1, 2021* -Django 3.2.5 fixes several bugs in 3.2.4. Also, the latest string translations -from Transifex are incorporated. +Django 3.2.5 fixes a security issue with severity "high" and several bugs in +3.2.4. Also, the latest string translations from Transifex are incorporated. + +CVE-2021-35042: Potential SQL injection via unsanitized ``QuerySet.order_by()`` input +===================================================================================== + +Unsanitized user input passed to ``QuerySet.order_by()`` could bypass intended +column reference validation in path marked for deprecation resulting in a +potential SQL injection even if a deprecation warning is emitted. + +As a mitigation the strict column reference validation was restored for the +duration of the deprecation period. This regression appeared in 3.1 as a side +effect of fixing :ticket:`31426`. + +The issue is not present in the main branch as the deprecated path has been +removed. Bugfixes ======== |