mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 10:59:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter.

Browse source
This commit is contained in:
Simon Charette 2019-12-31 12:46:06 -05:00 • committed by Carlton Gibson
parent 6b178a3e93
commit eb31d84532
7 changed files with 45 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/releases/1.11.28.txt Normal file
View file

@ -0,0 +1,13 @@
============================
Django 1.11.28 release notes
============================
*February 3, 2020*
Django 1.11.28 fixes a security issue in 1.11.27.
CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)``
===================================================================
:class:`~django.contrib.postgres.aggregates.StringAgg` aggregation function was
subject to SQL injection, using a suitably crafted ``delimiter``.

13
docs/releases/2.2.10.txt Normal file
View file

@ -0,0 +1,13 @@
===========================
Django 2.2.10 release notes
===========================
*February 3, 2020*
Django 2.2.10 fixes a security issue in 2.2.9.
CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)``
===================================================================
:class:`~django.contrib.postgres.aggregates.StringAgg` aggregation function was
subject to SQL injection, using a suitably crafted ``delimiter``.

8
docs/releases/3.0.3.txt
View file

@ -4,7 +4,13 @@ Django 3.0.3 release notes
*Expected February 3, 2020*
Django 3.0.3 fixes several bugs in 3.0.2.
Django 3.0.3 fixes a security issue and several bugs in 3.0.2.
CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)``
===================================================================
:class:`~django.contrib.postgres.aggregates.StringAgg` aggregation function was
subject to SQL injection, using a suitably crafted ``delimiter``.
Bugfixes
========

2
docs/releases/index.txt
View file

@ -42,6 +42,7 @@ versions of the documentation contain the release notes for any later releases.
.. toctree::
:maxdepth: 1
2.2.10
2.2.9
2.2.8
2.2.7
@ -100,6 +101,7 @@ versions of the documentation contain the release notes for any later releases.
.. toctree::
:maxdepth: 1
1.11.28
1.11.27
1.11.26
1.11.25