Django - 2.2.27
Security
Django 2.2.27 release notes
February 1, 2022
Django 2.2.27 fixes two security issues with severity “medium” in 2.2.26.
CVE-2022-22818: Possible XSS via {% debug %}
template tag
The {% debug %}
template tag didn’t properly encode the current context,
posing an XSS attack vector.
In order to avoid this vulnerability, {% debug %}
no longer outputs an
information when the DEBUG
setting is False
, and it ensures all context
variables are correctly escaped when the DEBUG
setting is True
.
CVE-2022-23833: Denial-of-service possibility in file uploads
Passing certain inputs to multipart forms could result in an infinite loop when
parsing files.
Security
Details
date
Feb. 1, 2022, 7:07 a.m.
type
Patch
official page
👇
Register or login to:
- 🔍View and search all Django releases.
- 🛠️Create and share lists to track your tools.
- 🚨Setup notifications for major, security, feature or patch updates.
- 🚀Much more coming soon!