summaryrefslogtreecommitdiff
path: root/docs/releases/security.txt
diff options
context:
space:
mode:
authorDavid Smith <smithdc@gmail.com>2025-07-25 10:24:17 +0100
committernessita <124304+nessita@users.noreply.github.com>2025-08-25 10:51:10 -0300
commitf81e6e3a53ee36e3f730a71aa55a5744982dd016 (patch)
tree44a4fdd64e2d1489d80b1af8bd1ac3c7af3ad0dd /docs/releases/security.txt
parent4286a23df64f6ce3b9b6ed097f4d1aac7d9e0de4 (diff)
Refs #36485 -- Rewrapped docs to 79 columns line length.
Lines in the docs files were manually adjusted to conform to the 79 columns limit per line (plus newline), improving readability and consistency across the content.
Diffstat (limited to 'docs/releases/security.txt')
-rw-r--r--docs/releases/security.txt57
1 files changed, 35 insertions, 22 deletions
diff --git a/docs/releases/security.txt b/docs/releases/security.txt
index 353f1a9b96..46c5dbc49d 100644
--- a/docs/releases/security.txt
+++ b/docs/releases/security.txt
@@ -713,8 +713,9 @@ Versions affected
August 1, 2019 - :cve:`2019-14232`
----------------------------------
-Denial-of-service possibility in ``django.utils.text.Truncator``. `Full
-description <https://www.djangoproject.com/weblog/2019/aug/01/security-releases/>`__
+Denial-of-service possibility in ``django.utils.text.Truncator``.
+`Full description
+<https://www.djangoproject.com/weblog/2019/aug/01/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -726,8 +727,9 @@ Versions affected
July 1, 2019 - :cve:`2019-12781`
--------------------------------
-Incorrect HTTP detection with reverse-proxy connecting via HTTPS. `Full
-description <https://www.djangoproject.com/weblog/2019/jul/01/security-releases/>`__
+Incorrect HTTP detection with reverse-proxy connecting via HTTPS.
+`Full description
+<https://www.djangoproject.com/weblog/2019/jul/01/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -739,8 +741,9 @@ Versions affected
June 3, 2019 - :cve:`2019-12308`
--------------------------------
-XSS via "Current URL" link generated by ``AdminURLFieldWidget``. `Full
-description <https://www.djangoproject.com/weblog/2019/jun/03/security-releases/>`__
+XSS via "Current URL" link generated by ``AdminURLFieldWidget``.
+`Full description
+<https://www.djangoproject.com/weblog/2019/jun/03/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -855,8 +858,9 @@ Versions affected
September 5, 2017 - :cve:`2017-12794`
-------------------------------------
-Possible XSS in traceback section of technical 500 debug page. `Full
-description <https://www.djangoproject.com/weblog/2017/sep/05/security-releases/>`__
+Possible XSS in traceback section of technical 500 debug page.
+`Full description
+<https://www.djangoproject.com/weblog/2017/sep/05/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -867,8 +871,9 @@ Versions affected
April 4, 2017 - :cve:`2017-7234`
--------------------------------
-Open redirect vulnerability in ``django.views.static.serve()``. `Full
-description <https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>`__
+Open redirect vulnerability in ``django.views.static.serve()``.
+`Full description
+<https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -881,7 +886,8 @@ April 4, 2017 - :cve:`2017-7233`
--------------------------------
Open redirect and possible XSS attack via user-supplied numeric redirect URLs.
-`Full description <https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>`__
+`Full description
+<https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -906,8 +912,9 @@ Versions affected
November 1, 2016 - :cve:`2016-9013`
-----------------------------------
-User with hardcoded password created when running tests on Oracle. `Full
-description <https://www.djangoproject.com/weblog/2016/nov/01/security-releases/>`__
+User with hardcoded password created when running tests on Oracle.
+`Full description
+<https://www.djangoproject.com/weblog/2016/nov/01/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -994,7 +1001,8 @@ August 18, 2015 - :cve:`2015-5963` / :cve:`2015-5964`
-----------------------------------------------------
Denial-of-service possibility in ``logout()`` view by filling session store.
-`Full description <https://www.djangoproject.com/weblog/2015/aug/18/security-releases/>`__
+`Full description
+<https://www.djangoproject.com/weblog/2015/aug/18/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -1017,8 +1025,9 @@ Versions affected
July 8, 2015 - :cve:`2015-5144`
-------------------------------
-Header injection possibility since validators accept newlines in input. `Full
-description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
+Header injection possibility since validators accept newlines in input.
+`Full description
+<https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -1030,8 +1039,9 @@ Versions affected
July 8, 2015 - :cve:`2015-5143`
-------------------------------
-Denial-of-service possibility by filling session store. `Full
-description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
+Denial-of-service possibility by filling session store.
+`Full description
+<https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -1054,8 +1064,9 @@ Versions affected
March 18, 2015 - :cve:`2015-2317`
---------------------------------
-Mitigated possible XSS attack via user-supplied redirect URLs. `Full
-description <https://www.djangoproject.com/weblog/2015/mar/18/security-releases/>`__
+Mitigated possible XSS attack via user-supplied redirect URLs.
+`Full description
+<https://www.djangoproject.com/weblog/2015/mar/18/security-releases/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -1145,7 +1156,8 @@ August 20, 2014 - :cve:`2014-0483`
----------------------------------
Data leakage via querystring manipulation in admin.
-`Full description <https://www.djangoproject.com/weblog/2014/aug/20/security/>`__
+`Full description
+<https://www.djangoproject.com/weblog/2014/aug/20/security/>`__
Versions affected
~~~~~~~~~~~~~~~~~
@@ -1276,7 +1288,8 @@ Denial-of-service via large passwords. `Full description
Versions affected
~~~~~~~~~~~~~~~~~
-* Django 1.4 :commit:`(patch <3f3d887a6844ec2db743fee64c9e53e04d39a368>` and :commit:`Python compatibility fix) <6903d1690a92aa040adfb0c8eb37cf62e4206714>`
+* Django 1.4 :commit:`(patch <3f3d887a6844ec2db743fee64c9e53e04d39a368>` and
+ :commit:`Python compatibility fix) <6903d1690a92aa040adfb0c8eb37cf62e4206714>`
* Django 1.5 :commit:`(patch) <22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc>`
September 10, 2013 - :cve:`2013-4315`