diff options
Diffstat (limited to 'docs/releases/3.0.1.txt')
| -rw-r--r-- | docs/releases/3.0.1.txt | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/docs/releases/3.0.1.txt b/docs/releases/3.0.1.txt index b923661bd2..1c32528304 100644 --- a/docs/releases/3.0.1.txt +++ b/docs/releases/3.0.1.txt @@ -2,9 +2,25 @@ Django 3.0.1 release notes ========================== -*Expected January 2, 2020* +*December 18, 2019* -Django 3.0.1 fixes several bugs in 3.0. +Django 3.0.1 fixes a security issue and several bugs in 3.0. + +CVE-2019-19844: Potential account hijack via password reset form +================================================================ + +By submitting a suitably crafted email address making use of Unicode +characters, that compared equal to an existing user email when lower-cased for +comparison, an attacker could be sent a password reset token for the matched +account. + +In order to avoid this vulnerability, password reset requests now compare the +submitted email using the stricter, recommended algorithm for case-insensitive +comparison of two identifiers from `Unicode Technical Report 36, section +2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be +sent to the email address on record rather than the submitted address. + +.. __: https://www.unicode.org/reports/tr36/#Recommendations_General Bugfixes ======== |