January 4, 2022
\nDjango 2.2.26 fixes one security issue with severity “medium” and two security\nissues with severity “low” in 2.2.25.
\nUserAttributeSimilarityValidatorLink to this heading#UserAttributeSimilarityValidator incurred significant overhead\nevaluating submitted password that were artificially large in relative to the\ncomparison values. On the assumption that access to user registration was\nunrestricted this provided a potential vector for a denial-of-service attack.
In order to mitigate this issue, relatively long values are now ignored by\nUserAttributeSimilarityValidator.
This issue has severity “medium” according to the Django security policy.
\ndictsort template filterLink to this heading#Due to leveraging the Django Template Language’s variable resolution logic, the\ndictsort template filter was potentially vulnerable to information\ndisclosure or unintended method calls, if passed a suitably crafted key.
In order to avoid this possibility, dictsort now works with a restricted\nresolution logic, that will not call methods, nor allow indexing on\ndictionaries.
As a reminder, all untrusted user input should be validated before use.
\nThis issue has severity “low” according to the Django security policy.
\nStorage.save()Link to this heading#Storage.save() allowed directory-traversal if directly passed suitably\ncrafted file names.
This issue has severity “low” according to the Django security policy.
\n