diff options
| author | Carlton Gibson <carlton.gibson@noumenal.es> | 2022-07-20 12:14:45 +0200 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2022-08-03 08:47:19 +0200 |
| commit | 46916665f9aa729067ef894e994854ecf9223157 (patch) | |
| tree | d5212a74e71dd85a40077ee9a2666f08badceaaa /docs | |
| parent | 5359607c89ddd6022f5c9da5e1e3c04cdab9e07d (diff) | |
[4.1.x] Fixed CVE-2022-36359 -- Escaped filename in Content-Disposition header.
Thanks to Motoyasu Saburi for the report.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/3.2.15.txt | 8 | ||||
| -rw-r--r-- | docs/releases/4.0.7.txt | 8 |
2 files changed, 14 insertions, 2 deletions
diff --git a/docs/releases/3.2.15.txt b/docs/releases/3.2.15.txt index a7a56ae965..281444ecf2 100644 --- a/docs/releases/3.2.15.txt +++ b/docs/releases/3.2.15.txt @@ -6,4 +6,10 @@ Django 3.2.15 release notes Django 3.2.15 fixes a security issue with severity "high" in 3.2.14. -... +CVE-2022-36359: Potential reflected file download vulnerability in ``FileResponse`` +=================================================================================== + +An application may have been vulnerable to a reflected file download (RFD) +attack that sets the Content-Disposition header of a +:class:`~django.http.FileResponse` when the ``filename`` was derived from +user-supplied input. The ``filename`` is now escaped to avoid this possibility. diff --git a/docs/releases/4.0.7.txt b/docs/releases/4.0.7.txt index 919f3520de..7fb8555077 100644 --- a/docs/releases/4.0.7.txt +++ b/docs/releases/4.0.7.txt @@ -6,4 +6,10 @@ Django 4.0.7 release notes Django 4.0.7 fixes a security issue with severity "high" in 4.0.6. -... +CVE-2022-36359: Potential reflected file download vulnerability in ``FileResponse`` +=================================================================================== + +An application may have been vulnerable to a reflected file download (RFD) +attack that sets the Content-Disposition header of a +:class:`~django.http.FileResponse` when the ``filename`` was derived from +user-supplied input. The ``filename`` is now escaped to avoid this possibility. |