diff options
| author | Adam Johnson <me@adamj.eu> | 2024-06-24 15:30:59 +0200 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2024-07-09 09:42:12 -0300 |
| commit | 44aef996c8d723198e89ca834cb1d746e2e72d77 (patch) | |
| tree | 4ab9dc5395942482de8294257568f388ab3b94bd /docs | |
| parent | 79246129f706d3fcedfb565d75c2e7df09fc496f (diff) | |
[5.1.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters.
Thank you to Elias Myllymäki for the report.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/4.2.14.txt | 6 | ||||
| -rw-r--r-- | docs/releases/5.0.7.txt | 7 |
2 files changed, 13 insertions, 0 deletions
diff --git a/docs/releases/4.2.14.txt b/docs/releases/4.2.14.txt index a0d95a477b..f32c0cf8d4 100644 --- a/docs/releases/4.2.14.txt +++ b/docs/releases/4.2.14.txt @@ -7,3 +7,9 @@ Django 4.2.14 release notes Django 4.2.14 fixes two security issues with severity "moderate" and two security issues with severity "low" in 4.2.13. +CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via certain inputs with a very large number of +brackets. diff --git a/docs/releases/5.0.7.txt b/docs/releases/5.0.7.txt index 0bee6d57ce..f25bc1f37d 100644 --- a/docs/releases/5.0.7.txt +++ b/docs/releases/5.0.7.txt @@ -7,6 +7,13 @@ Django 5.0.7 release notes Django 5.0.7 fixes two security issues with severity "moderate", two security issues with severity "low", and several bugs in 5.0.6. +CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` +=========================================================================================== + +:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential +denial-of-service attack via certain inputs with a very large number of +brackets. + Bugfixes ======== |