diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2020-02-24 14:46:28 +0100 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2020-03-04 09:34:39 +0100 |
| commit | fe886a3b58a93cfbe8864b485f93cb6d426cd1f2 (patch) | |
| tree | ca577650416169c886986fd51054283a0d0867f7 /docs | |
| parent | 7deb87c93e5f45ded3ccd1e6162bed6a30000af8 (diff) | |
[2.2.x] Fixed CVE-2020-9402 -- Properly escaped tolerance parameter in GIS functions and aggregates on Oracle.
Thanks to Norbert Szetei for the report.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.11.29.txt | 13 | ||||
| -rw-r--r-- | docs/releases/2.2.11.txt | 10 | ||||
| -rw-r--r-- | docs/releases/index.txt | 1 |
3 files changed, 22 insertions, 2 deletions
diff --git a/docs/releases/1.11.29.txt b/docs/releases/1.11.29.txt new file mode 100644 index 0000000000..d37f3ffc0d --- /dev/null +++ b/docs/releases/1.11.29.txt @@ -0,0 +1,13 @@ +============================ +Django 1.11.29 release notes +============================ + +*March 4, 2020* + +Django 1.11.29 fixes a security issue in 1.11.29. + +CVE-2020-9402: Potential SQL injection via ``tolerance`` parameter in GIS functions and aggregates on Oracle +============================================================================================================ + +GIS functions and aggregates on Oracle were subject to SQL injection, +using a suitably crafted ``tolerance``. diff --git a/docs/releases/2.2.11.txt b/docs/releases/2.2.11.txt index b14d961ac3..9738ef4470 100644 --- a/docs/releases/2.2.11.txt +++ b/docs/releases/2.2.11.txt @@ -2,9 +2,15 @@ Django 2.2.11 release notes =========================== -*Expected March 2, 2020* +*March 4, 2020* -Django 2.2.11 fixes a data loss bug in 2.2.10. +Django 2.2.11 fixes a security issue and a data loss bug in 2.2.10. + +CVE-2020-9402: Potential SQL injection via ``tolerance`` parameter in GIS functions and aggregates on Oracle +============================================================================================================ + +GIS functions and aggregates on Oracle were subject to SQL injection, +using a suitably crafted ``tolerance``. Bugfixes ======== diff --git a/docs/releases/index.txt b/docs/releases/index.txt index 48d566a276..d83da503ee 100644 --- a/docs/releases/index.txt +++ b/docs/releases/index.txt @@ -85,6 +85,7 @@ versions of the documentation contain the release notes for any later releases. .. toctree:: :maxdepth: 1 + 1.11.29 1.11.28 1.11.27 1.11.26 |