From c89ab95a3684c48dd377602686b85631f3f2be3c Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Fri, 1 Feb 2019 15:42:48 -0500 Subject: [2.0.x] Used extlinks for GitHub commits. Backport of c34c6d0a2fc6d9bc55fb2db94b9ed40141babb15 from master. --- docs/conf.py | 1 + docs/internals/howto-release-django.txt | 4 +- docs/releases/security.txt | 340 ++++++++++++++++---------------- 3 files changed, 172 insertions(+), 173 deletions(-) diff --git a/docs/conf.py b/docs/conf.py index 7ab9552709..97fef7721f 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -44,6 +44,7 @@ extensions = [ ] extlinks = { + 'commit': ('https://github.com/django/django/commit/%s', ''), 'cve': ('https://nvd.nist.gov/view/vuln/detail?vulnId=%s', 'CVE-'), 'ticket': ('https://code.djangoproject.com/ticket/%s', '#'), } diff --git a/docs/internals/howto-release-django.txt b/docs/internals/howto-release-django.txt index 6d31b17797..392d2c873b 100644 --- a/docs/internals/howto-release-django.txt +++ b/docs/internals/howto-release-django.txt @@ -180,9 +180,7 @@ OK, this is the fun part, where we actually push out a release! checkout security/1.5.x; git rebase stable/1.5.x``) and then switch back and do the merge. Make sure the commit message for each security fix explains that the commit is a security fix and that an announcement will follow - (`example security commit`__). - - __ https://github.com/django/django/commit/3ef4bbf495cc6c061789132e3d50a8231a89406b + (:commit:`example security commit `). #. For a feature release, remove the ``UNDER DEVELOPMENT`` header at the top of the release notes and add the release date on the next line. For a diff --git a/docs/releases/security.txt b/docs/releases/security.txt index 6c34c2f1dd..d62ebd96df 100644 --- a/docs/releases/security.txt +++ b/docs/releases/security.txt @@ -46,9 +46,9 @@ Filename validation issue in translation framework. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 0.90 `(patch) `__ -* Django 0.91 `(patch) `__ -* Django 0.95 `(patch) `__ (released January 21 2007) +* Django 0.90 :commit:`(patch) <518d406e53>` +* Django 0.91 :commit:`(patch) <518d406e53>` +* Django 0.95 :commit:`(patch) ` (released January 21 2007) January 21, 2007 - :cve:`2007-0405` ----------------------------------- @@ -59,7 +59,7 @@ Apparent "caching" of authenticated user. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 0.95 `(patch) `__ +* Django 0.95 :commit:`(patch) ` Issues under Django's security process ====================================== @@ -76,9 +76,9 @@ description `__ Versions affected ~~~~~~~~~~~~~~~~~ -* Django 0.91 `(patch) `__ -* Django 0.95 `(patch) `__ -* Django 0.96 `(patch) `__ +* Django 0.91 :commit:`(patch) <8bc36e726c9e8c75c681d3ad232df8e882aaac81>` +* Django 0.95 :commit:`(patch) <412ed22502e11c50dbfee854627594f0e7e2c234>` +* Django 0.96 :commit:`(patch) <7dd2dd08a79e388732ce00e2b5514f15bd6d0f6f>` May 14, 2008 - :cve:`2008-2302` ------------------------------- @@ -89,9 +89,9 @@ XSS via admin login redirect. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 0.91 `(patch) `__ -* Django 0.95 `(patch) `__ -* Django 0.96 `(patch) `__ +* Django 0.91 :commit:`(patch) <50ce7fb57d>` +* Django 0.95 :commit:`(patch) <50ce7fb57d>` +* Django 0.96 :commit:`(patch) <7791e5c050>` September 2, 2008 - :cve:`2008-3909` ------------------------------------ @@ -102,9 +102,9 @@ CSRF via preservation of POST data during admin login. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 0.91 `(patch) `__ -* Django 0.95 `(patch) `__ -* Django 0.96 `(patch) `__ +* Django 0.91 :commit:`(patch) <44debfeaa4473bd28872c735dd3d9afde6886752>` +* Django 0.95 :commit:`(patch) ` +* Django 0.96 :commit:`(patch) <7e0972bded362bc4b851c109df2c8a6548481a8e>` July 28, 2009 - :cve:`2009-2659` -------------------------------- @@ -115,8 +115,8 @@ Directory-traversal in development server media handler. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 0.96 `(patch) `__ -* Django 1.0 `(patch) `__ +* Django 0.96 :commit:`(patch) ` +* Django 1.0 :commit:`(patch) ` October 9, 2009 - :cve:`2009-3965` ---------------------------------- @@ -127,8 +127,8 @@ description `__ Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.0 `(patch) `__ -* Django 1.1 `(patch) `__ +* Django 1.0 :commit:`(patch) <594a28a904>` +* Django 1.1 :commit:`(patch) ` September 8, 2010 - :cve:`2010-3082` ------------------------------------ @@ -139,7 +139,7 @@ XSS via trusting unsafe cookie value. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.2 `(patch) `__ +* Django 1.2 :commit:`(patch) <7f84657b6b>` December 22, 2010 - :cve:`2010-4534` ------------------------------------ @@ -150,8 +150,8 @@ Information leakage in administrative interface. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.1 `(patch) `__ -* Django 1.2 `(patch) `__ +* Django 1.1 :commit:`(patch) <17084839fd>` +* Django 1.2 :commit:`(patch) <85207a245b>` December 22, 2010 - :cve:`2010-4535` ------------------------------------ @@ -162,8 +162,8 @@ Denial-of-service in password-reset mechanism. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.1 `(patch) `__ -* Django 1.2 `(patch) `__ +* Django 1.1 :commit:`(patch) <7f8dd9cbac>` +* Django 1.2 :commit:`(patch) ` February 8, 2011 - :cve:`2011-0696` ----------------------------------- @@ -174,8 +174,8 @@ CSRF via forged HTTP headers. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.1 `(patch) `__ -* Django 1.2 `(patch) `__ +* Django 1.1 :commit:`(patch) <408c5c873c>` +* Django 1.2 :commit:`(patch) <818e70344e>` February 8, 2011 - :cve:`2011-0697` ----------------------------------- @@ -186,8 +186,8 @@ XSS via unsanitized names of uploaded files. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.1 `(patch) `__ -* Django 1.2 `(patch) `__ +* Django 1.1 :commit:`(patch) <1966786d2d>` +* Django 1.2 :commit:`(patch) <1f814a9547>` February 8, 2011 - :cve:`2011-0698` ----------------------------------- @@ -198,8 +198,8 @@ description `__ Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.1 `(patch) `__ -* Django 1.2 `(patch) `__ +* Django 1.1 :commit:`(patch) <570a32a047>` +* Django 1.2 :commit:`(patch) <194566480b>` September 9, 2011 - :cve:`2011-4136` ------------------------------------ @@ -210,8 +210,8 @@ Session manipulation when using memory-cache-backed session. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.2 `(patch) `__ -* Django 1.3 `(patch) `__ +* Django 1.2 :commit:`(patch) ` +* Django 1.3 :commit:`(patch) ` September 9, 2011 - :cve:`2011-4137` ------------------------------------ @@ -222,8 +222,8 @@ Denial-of-service via ``URLField.verify_exists``. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.2 `(patch) `__ -* Django 1.3 `(patch) `__ +* Django 1.2 :commit:`(patch) <7268f8af86>` +* Django 1.3 :commit:`(patch) <1a76dbefdf>` September 9, 2011 - :cve:`2011-4138` ------------------------------------ @@ -235,8 +235,8 @@ Information leakage/arbitrary request issuance via ``URLField.verify_exists``. Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.2: `(patch) `__ -* Django 1.3: `(patch) `__ +* Django 1.2: :commit:`(patch) <7268f8af86>` +* Django 1.3: :commit:`(patch) <1a76dbefdf>` September 9, 2011 - :cve:`2011-4139` ------------------------------------ @@ -247,8 +247,8 @@ September 9, 2011 - :cve:`2011-4139` Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.2 `(patch) `__ -* Django 1.3 `(patch) `__ +* Django 1.2 :commit:`(patch) ` +* Django 1.3 :commit:`(patch) <2f7fadc38e>` September 9, 2011 - :cve:`2011-4140` ------------------------------------ @@ -273,8 +273,8 @@ XSS via failure to validate redirect scheme. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3: `(patch) `__ -* Django 1.4: `(patch) `__ +* Django 1.3: :commit:`(patch) <4dea4883e6c50d75f215a6b9bcbd95273f57c72d>` +* Django 1.4: :commit:`(patch) ` July 30, 2012 - :cve:`2012-3443` -------------------------------- @@ -285,8 +285,8 @@ Denial-of-service via compressed image files. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3: `(patch) `__ -* Django 1.4: `(patch) `__ +* Django 1.3: :commit:`(patch) ` +* Django 1.4: :commit:`(patch) ` July 30, 2012 - :cve:`2012-3444` -------------------------------- @@ -297,8 +297,8 @@ Denial-of-service via large image files. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.3 :commit:`(patch) <9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155>` +* Django 1.4 :commit:`(patch) ` October 17, 2012 - :cve:`2012-4520` ----------------------------------- @@ -309,8 +309,8 @@ October 17, 2012 - :cve:`2012-4520` Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.3 :commit:`(patch) ` +* Django 1.4 :commit:`(patch) <92d3430f12171f16f566c9050c40feefb830a4a3>` December 10, 2012 - No CVE 1 ---------------------------- @@ -321,8 +321,8 @@ Additional hardening of ``Host`` header handling. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.3 :commit:`(patch) <2da4ace0bc1bc1d79bf43b368cb857f6f0cd6b1b>` +* Django 1.4 :commit:`(patch) <319627c184e71ae267d6b7f000e293168c7b6e09>` December 10, 2012 - No CVE 2 ---------------------------- @@ -333,8 +333,8 @@ Additional hardening of redirect validation. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3: `(patch) `__ -* Django 1.4: `(patch) `__ +* Django 1.3: :commit:`(patch) <1515eb46daa0897ba5ad5f0a2db8969255f1b343>` +* Django 1.4: :commit:`(patch) ` February 19, 2013 - No CVE -------------------------- @@ -345,8 +345,8 @@ Additional hardening of ``Host`` header handling. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.3 :commit:`(patch) <27cd872e6e36a81d0bb6f5b8765a1705fecfc253>` +* Django 1.4 :commit:`(patch) <9936fdb11d0bbf0bd242f259bfb97bbf849d16f8>` February 19, 2013 - :cve:`2013-1664` / :cve:`2013-1665` ------------------------------------------------------- @@ -357,8 +357,8 @@ Entity-based attacks against Python XML libraries. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.3 :commit:`(patch) ` +* Django 1.4 :commit:`(patch) <1c60d07ba23e0350351c278ad28d0bd5aa410b40>` February 19, 2013 - :cve:`2013-0305` ------------------------------------ @@ -369,8 +369,8 @@ Information leakage via admin history log. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.3 :commit:`(patch) ` +* Django 1.4 :commit:`(patch) <0e7861aec73702f7933ce2a93056f7983939f0d6>` February 19, 2013 - :cve:`2013-0306` ------------------------------------ @@ -381,8 +381,8 @@ Denial-of-service via formset ``max_num`` bypass. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.3 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.3 :commit:`(patch) ` +* Django 1.4 :commit:`(patch) <0cc350a896f70ace18280410eb616a9197d862b0>` August 13, 2013 - :cve:`2013-4249` ---------------------------------- @@ -393,7 +393,7 @@ XSS via admin trusting ``URLField`` values. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.5 `(patch) `__ +* Django 1.5 :commit:`(patch) <90363e388c61874add3f3557ee654a996ec75d78>` August 13, 2013 - :cve:`2013-6044` ---------------------------------- @@ -404,8 +404,8 @@ Possible XSS via unvalidated URL redirect schemes. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ +* Django 1.4 :commit:`(patch) ` +* Django 1.5 :commit:`(patch) <1a274ccd6bc1afbdac80344c9b6e5810c1162b5f>` September 10, 2013 - :cve:`2013-4315` ------------------------------------- @@ -416,8 +416,8 @@ Directory-traversal via ``ssi`` template tag. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ +* Django 1.4 :commit:`(patch) <87d2750b39f6f2d54b7047225521a44dcd37e896>` +* Django 1.5 :commit:`(patch) <988b61c550d798f9a66d17ee0511fb7a9a7f33ca>` September 14, 2013 - :cve:`2013-1443` ------------------------------------- @@ -428,8 +428,8 @@ Denial-of-service via large passwords. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch `__ and `Python compatibility fix) `__ -* Django 1.5 `(patch) `__ +* Django 1.4 :commit:`(patch <3f3d887a6844ec2db743fee64c9e53e04d39a368>` and :commit:`Python compatibility fix) <6903d1690a92aa040adfb0c8eb37cf62e4206714>` +* Django 1.5 :commit:`(patch) <22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc>` April 21, 2014 - :cve:`2014-0472` --------------------------------- @@ -440,10 +440,10 @@ Unexpected code execution using ``reverse()``. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) ` +* Django 1.5 :commit:`(patch) <2a5bcb69f42b84464b24b5c835dca6467b6aa7f1>` +* Django 1.6 :commit:`(patch) <4352a50871e239ebcdf64eee6f0b88e714015c1b>` +* Django 1.7 :commit:`(patch) <546740544d7f69254a67b06a3fc7fa0c43512958>` April 21, 2014 - :cve:`2014-0473` --------------------------------- @@ -454,10 +454,10 @@ Caching of anonymous pages could reveal CSRF token. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) <1170f285ddd6a94a65f911a27788ba49ca08c0b0>` +* Django 1.5 :commit:`(patch) <6872f42757d7ef6a97e0b6ec5db4d2615d8a2bd8>` +* Django 1.6 :commit:`(patch) ` +* Django 1.7 :commit:`(patch) <380545bf85cbf17fc698d136815b7691f8d023ca>` April 21, 2014 - :cve:`2014-0474` --------------------------------- @@ -468,10 +468,10 @@ MySQL typecasting causes unexpected query results. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) ` +* Django 1.5 :commit:`(patch) <985434fb1d6bf2335bf96c6ebf91c3674f1f399f>` +* Django 1.6 :commit:`(patch) <5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292>` +* Django 1.7 :commit:`(patch) <34526c2f56b863c2103655a0893ac801667e86ea>` May 18, 2014 - :cve:`2014-1418` ------------------------------- @@ -482,10 +482,10 @@ Caches may be allowed to store and serve private data. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) <28e23306aa53bbbb8fb87db85f99d970b051026c>` +* Django 1.5 :commit:`(patch) <4001ec8698f577b973c5a540801d8a0bbea1205b>` +* Django 1.6 :commit:`(patch) <1abcf3a808b35abae5d425ed4d44cb6e886dc769>` +* Django 1.7 :commit:`(patch) <7fef18ba9e5a8b47bc24b5bb259c8bf3d3879f2a>` May 18, 2014 - :cve:`2014-3730` ------------------------------- @@ -496,10 +496,10 @@ Malformed URLs from user input incorrectly validated. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) <7feb54bbae3f637ab3c4dd4831d4385964f574df>` +* Django 1.5 :commit:`(patch) ` +* Django 1.6 :commit:`(patch) <601107524523bca02376a0ddc1a06c6fdb8f22f3>` +* Django 1.7 :commit:`(patch) ` August 20, 2014 - :cve:`2014-0480` ---------------------------------- @@ -510,10 +510,10 @@ August 20, 2014 - :cve:`2014-0480` Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) ` +* Django 1.5 :commit:`(patch) <45ac9d4fb087d21902469fc22643f5201d41a0cd>` +* Django 1.6 :commit:`(patch) ` +* Django 1.7 :commit:`(patch) ` August 20, 2014 - :cve:`2014-0481` ---------------------------------- @@ -524,10 +524,10 @@ File upload denial of service. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) <30042d475bf084c6723c6217a21598d9247a9c41>` +* Django 1.5 :commit:`(patch) <26cd48e166ac4d84317c8ee6d63ac52a87e8da99>` +* Django 1.6 :commit:`(patch) ` +* Django 1.7 :commit:`(patch) <3123f8452cf49071be9110e277eea60ba0032216>` August 20, 2014 - :cve:`2014-0482` ---------------------------------- @@ -538,10 +538,10 @@ August 20, 2014 - :cve:`2014-0482` Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) ` +* Django 1.5 :commit:`(patch) ` +* Django 1.6 :commit:`(patch) <0268b855f9eab3377f2821164ef3e66037789e09>` +* Django 1.7 :commit:`(patch) <1a45d059c70385fcd6f4a3955f3b4e4cc96d0150>` August 20, 2014 - :cve:`2014-0483` ---------------------------------- @@ -552,10 +552,10 @@ Data leakage via querystring manipulation in admin. Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.5 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) <027bd348642007617518379f8b02546abacaa6e0>` +* Django 1.5 :commit:`(patch) <2a446c896e7c814661fb9c4f212b071b2a7fa446>` +* Django 1.6 :commit:`(patch) ` +* Django 1.7 :commit:`(patch) <2b31342cdf14fc20e07c43d258f1e7334ad664a6>` January 13, 2015 - :cve:`2015-0219` ----------------------------------- @@ -566,9 +566,9 @@ WSGI header spoofing via underscore/dash conflation. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) <4f6fffc1dc429f1ad428ecf8e6620739e8837450>` +* Django 1.6 :commit:`(patch) ` +* Django 1.7 :commit:`(patch) <41b4bc73ee0da7b2e09f4af47fc1fd21144c710f>` January 13, 2015 - :cve:`2015-0220` ----------------------------------- @@ -579,9 +579,9 @@ description `__ Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) <4c241f1b710da6419d9dca160e80b23b82db7758>` +* Django 1.6 :commit:`(patch) <72e0b033662faa11bb7f516f18a132728aa0ae28>` +* Django 1.7 :commit:`(patch) ` January 13, 2015 - :cve:`2015-0221` ----------------------------------- @@ -592,9 +592,9 @@ description `__ Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.4 `(patch) `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.4 :commit:`(patch) ` +* Django 1.6 :commit:`(patch) <553779c4055e8742cc832ed525b9ee34b174934f>` +* Django 1.7 :commit:`(patch) <818e59a3f0fbadf6c447754d202d88df025f8f2a>` January 13, 2015 - :cve:`2015-0222` ----------------------------------- @@ -605,8 +605,8 @@ Database denial-of-service with ``ModelMultipleChoiceField``. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.6 :commit:`(patch) ` +* Django 1.7 :commit:`(patch) ` March 9, 2015 - :cve:`2015-2241` -------------------------------- @@ -617,8 +617,8 @@ XSS attack via properties in ``ModelAdmin.readonly_fields``. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.7 `(patch) `__ -* Django 1.8 `(patch) `_ +* Django 1.7 :commit:`(patch) ` +* Django 1.8 :commit:`(patch) <2654e1b93923bac55f12b4e66c5e39b16695ace5>` March 18, 2015 - :cve:`2015-2316` --------------------------------- @@ -629,9 +629,9 @@ Denial-of-service possibility with ``strip_tags()``. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.6 :commit:`(patch) ` +* Django 1.7 :commit:`(patch) ` +* Django 1.8 :commit:`(patch) <5447709a571cd5d95971f1d5d21d4a7edcf85bbd>` March 18, 2015 - :cve:`2015-2317` --------------------------------- @@ -642,10 +642,10 @@ description `__ -* Django 1.6 `(patch) `__ -* Django 1.7 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.4 :commit:`(patch) <2342693b31f740a422abf7267c53b4e7bc487c1b>` +* Django 1.6 :commit:`(patch) <5510f070711540aaa8d3707776cd77494e688ef9>` +* Django 1.7 :commit:`(patch) <2a4113dbd532ce952308992633d802dc169a75f1>` +* Django 1.8 :commit:`(patch) <770427c2896a078925abfca2317486b284d22f04>` May 20, 2015 - :cve:`2015-3982` ------------------------------- @@ -656,7 +656,7 @@ Fixed session flushing in the cached_db backend. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.8 `(patch) `__ +* Django 1.8 :commit:`(patch) <31cb25adecba930bdeee4556709f5a1c42d88fd6>` July 8, 2015 - :cve:`2015-5143` ------------------------------- @@ -667,9 +667,9 @@ description `__ -* Django 1.7 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.8 :commit:`(patch) <66d12d1ababa8f062857ee5eb43276493720bf16>` +* Django 1.7 :commit:`(patch) <1828f4341ec53a8684112d24031b767eba557663>` +* Django 1.4 :commit:`(patch) <2e47f3e401c29bc2ba5ab794d483cb0820855fb9>` July 8, 2015 - :cve:`2015-5144` ------------------------------- @@ -680,9 +680,9 @@ description `__ -* Django 1.7 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.8 :commit:`(patch) <574dd5e0b0fbb877ae5827b1603d298edc9bb2a0>` +* Django 1.7 :commit:`(patch) ` +* Django 1.4 :commit:`(patch) <1ba1cdce7d58e6740fe51955d945b56ae51d072a>` July 8, 2015 - :cve:`2015-5145` ------------------------------- @@ -693,7 +693,7 @@ Denial-of-service possibility in URL validation. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.8 `(patch) `__ +* Django 1.8 :commit:`(patch) <8f9a4d3a2bc42f14bb437defd30c7315adbff22c>` August 18, 2015 - :cve:`2015-5963` / :cve:`2015-5964` ----------------------------------------------------- @@ -704,9 +704,9 @@ Denial-of-service possibility in ``logout()`` view by filling session store. Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.8 `(patch) `__ -* Django 1.7 `(patch) `__ -* Django 1.4 `(patch) `__ +* Django 1.8 :commit:`(patch) <2eb86b01d7b59be06076f6179a454d0fd0afaff6>` +* Django 1.7 :commit:`(patch) <2f5485346ee6f84b4e52068c04e043092daf55f7>` +* Django 1.4 :commit:`(patch) <575f59f9bc7c59a5e41a081d1f5f55fc859c5012>` November 24, 2015 - :cve:`2015-8213` ------------------------------------ @@ -717,8 +717,8 @@ Settings leak possibility in ``date`` template filter. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.8 `(patch) `__ -* Django 1.7 `(patch) `__ +* Django 1.8 :commit:`(patch) <9f83fc2f66f5a0bac7c291aec55df66050bb6991>` +* Django 1.7 :commit:`(patch) <8a01c6b53169ee079cb21ac5919fdafcc8c5e172>` February 1, 2016 - :cve:`2016-2048` ----------------------------------- @@ -730,7 +730,7 @@ User with "change" but not "add" permission can create objects for Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.9 `(patch) `__ +* Django 1.9 :commit:`(patch) ` March 1, 2016 - :cve:`2016-2512` -------------------------------- @@ -742,8 +742,8 @@ containing basic auth. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.9 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.9 :commit:`(patch) ` +* Django 1.8 :commit:`(patch) <382ab137312961ad62feb8109d70a5a581fe8350>` March 1, 2016 - :cve:`2016-2513` -------------------------------- @@ -755,8 +755,8 @@ upgrade. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.9 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.9 :commit:`(patch) ` +* Django 1.8 :commit:`(patch) ` July 18, 2016 - :cve:`2016-6186` -------------------------------- @@ -767,8 +767,8 @@ XSS in admin's add/change related popup. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.9 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.9 :commit:`(patch) ` +* Django 1.8 :commit:`(patch) ` September 26, 2016 - :cve:`2016-7401` ------------------------------------- @@ -779,8 +779,8 @@ CSRF protection bypass on a site with Google Analytics. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.9 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.9 :commit:`(patch) ` +* Django 1.8 :commit:`(patch) <6118ab7d0676f0d622278e5be215f14fb5410b6a>` November 1, 2016 - :cve:`2016-9013` ----------------------------------- @@ -791,9 +791,9 @@ description `__ -* Django 1.9 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.10 :commit:`(patch) <34e10720d81b8d407aa14d763b6a7fe8f13b4f2e>` +* Django 1.9 :commit:`(patch) <4844d86c7728c1a5a3bbce4ad336a8d32304072b>` +* Django 1.8 :commit:`(patch) <70f99952965a430daf69eeb9947079aae535d2d0>` November 1, 2016 - :cve:`2016-9014` ----------------------------------- @@ -804,9 +804,9 @@ DNS rebinding vulnerability when ``DEBUG=True``. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.10 `(patch) `__ -* Django 1.9 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.10 :commit:`(patch) <884e113838e5a72b4b0ec9e5e87aa480f6aa4472>` +* Django 1.9 :commit:`(patch) <45acd6d836895a4c36575f48b3fb36a3dae98d19>` +* Django 1.8 :commit:`(patch) ` April 4, 2017 - :cve:`2017-7233` -------------------------------- @@ -817,9 +817,9 @@ Open redirect and possible XSS attack via user-supplied numeric redirect URLs. Versions affected ~~~~~~~~~~~~~~~~~ -* Django 1.10 `(patch) `__ -* Django 1.9 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.10 :commit:`(patch) ` +* Django 1.9 :commit:`(patch) <254326cb3682389f55f886804d2c43f7b9f23e4f>` +* Django 1.8 :commit:`(patch) <8339277518c7d8ec280070a780915304654e3b66>` April 4, 2017 - :cve:`2017-7234` -------------------------------- @@ -830,9 +830,9 @@ description `__ -* Django 1.9 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 1.10 :commit:`(patch) <2a9f6ef71b8e23fd267ee2be1be26dde8ab67037>` +* Django 1.9 :commit:`(patch) <5f1ffb07afc1e59729ce2b283124116d6c0659e4>` +* Django 1.8 :commit:`(patch) <4a6b945dffe8d10e7cec107d93e6efaebfbded29>` September 5, 2017 - :cve:`2017-12794` ------------------------------------- @@ -843,8 +843,8 @@ description `__ -* Django 1.10 `(patch) `__ +* Django 1.11 :commit:`(patch) ` +* Django 1.10 :commit:`(patch) <58e08e80e362db79eb0fd775dc81faad90dca47a>` February 1, 2018 - :cve:`2018-6188` ----------------------------------- @@ -855,8 +855,8 @@ Information leakage in ``AuthenticationForm``. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 2.0 `(patch) `__ -* Django 1.11 `(patch) `__ +* Django 2.0 :commit:`(patch) ` +* Django 1.11 :commit:`(patch) <57b95fedad5e0b83fc9c81466b7d1751c6427aae>` March 6, 2018 - :cve:`2018-7536` -------------------------------- @@ -868,9 +868,9 @@ filters. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 2.0 `(patch) `__ -* Django 1.11 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 2.0 :commit:`(patch) ` +* Django 1.11 :commit:`(patch) ` +* Django 1.8 :commit:`(patch) <1ca63a66ef3163149ad822701273e8a1844192c2>` March 6, 2018 - :cve:`2018-7537` -------------------------------- @@ -882,9 +882,9 @@ Denial-of-service possibility in ``truncatechars_html`` and Versions affected ~~~~~~~~~~~~~~~~~ -* Django 2.0 `(patch) `__ -* Django 1.11 `(patch) `__ -* Django 1.8 `(patch) `__ +* Django 2.0 :commit:`(patch) <94c5da1d17a6b0d378866c66b605102c19f7988c>` +* Django 1.11 :commit:`(patch) ` +* Django 1.8 :commit:`(patch) ` August 1, 2018 - :cve:`2018-14574` ---------------------------------- @@ -895,9 +895,9 @@ Open redirect possibility in ``CommonMiddleware``. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 2.1 `(patch) `__ -* Django 2.0 `(patch) `__ -* Django 1.11 `(patch) `__ +* Django 2.1 :commit:`(patch) ` +* Django 2.0 :commit:`(patch) <6fffc3c6d420e44f4029d5643f38d00a39b08525>` +* Django 1.11 :commit:`(patch) ` October 1, 2018 - :cve:`2018-16984` ----------------------------------- @@ -908,7 +908,7 @@ Password hash disclosure to "view only" admin users. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 2.1 `(patch) `__ +* Django 2.1 :commit:`(patch) ` January 4, 2019 - :cve:`2019-3498` ---------------------------------- @@ -919,6 +919,6 @@ Content spoofing possibility in the default 404 page. `Full description Versions affected ~~~~~~~~~~~~~~~~~ -* Django 2.1 `(patch) `__ -* Django 2.0 `(patch) `__ -* Django 1.11 `(patch) `__ +* Django 2.1 :commit:`(patch) <64d2396e83aedba3fcc84ca40f23fbd22f0b9b5b>` +* Django 2.0 :commit:`(patch) <9f4ed7c94c62e21644ef5115e393ac426b886f2e>` +* Django 1.11 :commit:`(patch) <1cd00fcf52d089ef0fe03beabd05d59df8ea052a>` -- cgit v1.2.1