Nótaí scaoilte Django 2.2.26Link to this heading#

CVE-2021-45115: Féidearthacht seirbhíse a dhiúltú i UserAttributeSimilarityValidatorLink to this heading#

UserAttributeSimilarityValidator incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack.

D'fhonn an cheist seo a mhaolú, déanann UserAttributeSimilarityValidator` neamhaird anois ar luachanna réasúnta fada.

This issue has severity "medium" according to the Django security policy.

CVE-2021-45116: Nochtadh faisnéise féideartha i scagaire teimpléad ``dictsort`Link to this heading#

Mar gheall ar loighic réitigh athraitheach Teanga Teanga Teimpléad Django a ghiaráil, d'fhéadfadh an scagaire teimpléad:tfilter: dictsort leochaileach maidir le nochtadh faisnéise nó glaonna modh neamhbheartaithe, má chuirtear eochair deartha go cuí.

D'fhonn an fhéidearthacht seo a sheachaint, oibríonn dictsort anois le loighic réitigh srianta, nach nglacfaidh modhanna, ná ní cheadóidh innéacsú ar fhoclóirí.

Mar mheabhrúchán, ba chóir gach ionchur úsáideora gan iontaofa a bhailíochtú sula n-úsáidtear é.

This issue has severity "low" according to the Django security policy.

CVE-2021-45452: Aistriú féideartha stiúrthóireachta trí ``Storage.save () ``Link to this heading#

Ceadaíodh ``Storage.save () ``aistriú stiúrthóireachta má chuirtear ainmneacha comhaid déanta go cuí á rith go díreach.

This issue has severity "low" according to the Django security policy.