diff options
| author | David Smith <smithdc@gmail.com> | 2025-07-25 10:24:17 +0100 |
|---|---|---|
| committer | nessita <124304+nessita@users.noreply.github.com> | 2025-08-25 10:51:10 -0300 |
| commit | f81e6e3a53ee36e3f730a71aa55a5744982dd016 (patch) | |
| tree | 44a4fdd64e2d1489d80b1af8bd1ac3c7af3ad0dd /docs/releases/security.txt | |
| parent | 4286a23df64f6ce3b9b6ed097f4d1aac7d9e0de4 (diff) | |
Refs #36485 -- Rewrapped docs to 79 columns line length.
Lines in the docs files were manually adjusted to conform to the
79 columns limit per line (plus newline), improving readability and
consistency across the content.
Diffstat (limited to 'docs/releases/security.txt')
| -rw-r--r-- | docs/releases/security.txt | 57 |
1 files changed, 35 insertions, 22 deletions
diff --git a/docs/releases/security.txt b/docs/releases/security.txt index 353f1a9b96..46c5dbc49d 100644 --- a/docs/releases/security.txt +++ b/docs/releases/security.txt @@ -713,8 +713,9 @@ Versions affected August 1, 2019 - :cve:`2019-14232` ---------------------------------- -Denial-of-service possibility in ``django.utils.text.Truncator``. `Full -description <https://www.djangoproject.com/weblog/2019/aug/01/security-releases/>`__ +Denial-of-service possibility in ``django.utils.text.Truncator``. +`Full description +<https://www.djangoproject.com/weblog/2019/aug/01/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -726,8 +727,9 @@ Versions affected July 1, 2019 - :cve:`2019-12781` -------------------------------- -Incorrect HTTP detection with reverse-proxy connecting via HTTPS. `Full -description <https://www.djangoproject.com/weblog/2019/jul/01/security-releases/>`__ +Incorrect HTTP detection with reverse-proxy connecting via HTTPS. +`Full description +<https://www.djangoproject.com/weblog/2019/jul/01/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -739,8 +741,9 @@ Versions affected June 3, 2019 - :cve:`2019-12308` -------------------------------- -XSS via "Current URL" link generated by ``AdminURLFieldWidget``. `Full -description <https://www.djangoproject.com/weblog/2019/jun/03/security-releases/>`__ +XSS via "Current URL" link generated by ``AdminURLFieldWidget``. +`Full description +<https://www.djangoproject.com/weblog/2019/jun/03/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -855,8 +858,9 @@ Versions affected September 5, 2017 - :cve:`2017-12794` ------------------------------------- -Possible XSS in traceback section of technical 500 debug page. `Full -description <https://www.djangoproject.com/weblog/2017/sep/05/security-releases/>`__ +Possible XSS in traceback section of technical 500 debug page. +`Full description +<https://www.djangoproject.com/weblog/2017/sep/05/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -867,8 +871,9 @@ Versions affected April 4, 2017 - :cve:`2017-7234` -------------------------------- -Open redirect vulnerability in ``django.views.static.serve()``. `Full -description <https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>`__ +Open redirect vulnerability in ``django.views.static.serve()``. +`Full description +<https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -881,7 +886,8 @@ April 4, 2017 - :cve:`2017-7233` -------------------------------- Open redirect and possible XSS attack via user-supplied numeric redirect URLs. -`Full description <https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>`__ +`Full description +<https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -906,8 +912,9 @@ Versions affected November 1, 2016 - :cve:`2016-9013` ----------------------------------- -User with hardcoded password created when running tests on Oracle. `Full -description <https://www.djangoproject.com/weblog/2016/nov/01/security-releases/>`__ +User with hardcoded password created when running tests on Oracle. +`Full description +<https://www.djangoproject.com/weblog/2016/nov/01/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -994,7 +1001,8 @@ August 18, 2015 - :cve:`2015-5963` / :cve:`2015-5964` ----------------------------------------------------- Denial-of-service possibility in ``logout()`` view by filling session store. -`Full description <https://www.djangoproject.com/weblog/2015/aug/18/security-releases/>`__ +`Full description +<https://www.djangoproject.com/weblog/2015/aug/18/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -1017,8 +1025,9 @@ Versions affected July 8, 2015 - :cve:`2015-5144` ------------------------------- -Header injection possibility since validators accept newlines in input. `Full -description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__ +Header injection possibility since validators accept newlines in input. +`Full description +<https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -1030,8 +1039,9 @@ Versions affected July 8, 2015 - :cve:`2015-5143` ------------------------------- -Denial-of-service possibility by filling session store. `Full -description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__ +Denial-of-service possibility by filling session store. +`Full description +<https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -1054,8 +1064,9 @@ Versions affected March 18, 2015 - :cve:`2015-2317` --------------------------------- -Mitigated possible XSS attack via user-supplied redirect URLs. `Full -description <https://www.djangoproject.com/weblog/2015/mar/18/security-releases/>`__ +Mitigated possible XSS attack via user-supplied redirect URLs. +`Full description +<https://www.djangoproject.com/weblog/2015/mar/18/security-releases/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -1145,7 +1156,8 @@ August 20, 2014 - :cve:`2014-0483` ---------------------------------- Data leakage via querystring manipulation in admin. -`Full description <https://www.djangoproject.com/weblog/2014/aug/20/security/>`__ +`Full description +<https://www.djangoproject.com/weblog/2014/aug/20/security/>`__ Versions affected ~~~~~~~~~~~~~~~~~ @@ -1276,7 +1288,8 @@ Denial-of-service via large passwords. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 :commit:`(patch <3f3d887a6844ec2db743fee64c9e53e04d39a368>` and :commit:`Python compatibility fix) <6903d1690a92aa040adfb0c8eb37cf62e4206714>` +* Django 1.4 :commit:`(patch <3f3d887a6844ec2db743fee64c9e53e04d39a368>` and + :commit:`Python compatibility fix) <6903d1690a92aa040adfb0c8eb37cf62e4206714>` * Django 1.5 :commit:`(patch) <22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc>` September 10, 2013 - :cve:`2013-4315` |
