2021-05-25 08:38:20 +00:00
|
|
|
===========================
|
|
|
|
|
Django 3.1.12 release notes
|
|
|
|
|
===========================
|
|
|
|
|
|
2021-06-02 08:19:19 +00:00
|
|
|
*June 2, 2021*
|
2021-05-25 08:38:20 +00:00
|
|
|
|
|
|
|
|
Django 3.1.12 fixes two security issues in 3.1.11.
|
|
|
|
|
|
2021-05-17 09:26:36 +00:00
|
|
|
CVE-2021-33203: Potential directory traversal via ``admindocs``
|
|
|
|
|
===============================================================
|
|
|
|
|
|
|
|
|
|
Staff members could use the :mod:`~django.contrib.admindocs`
|
|
|
|
|
``TemplateDetailView`` view to check the existence of arbitrary files.
|
|
|
|
|
Additionally, if (and only if) the default admindocs templates have been
|
|
|
|
|
customized by the developers to also expose the file contents, then not only
|
|
|
|
|
the existence but also the file contents would have been exposed.
|
|
|
|
|
|
|
|
|
|
As a mitigation, path sanitation is now applied and only files within the
|
|
|
|
|
template root directories can be loaded.
|
