---
title: "Django 2.2.26 release notes"
version: 6.0
locale: pl
source: https://docs.djangoproject.com/pl/6.0/releases/2.2.26/
canonical: https://djangodocs.dev/pl/6.0/releases/2.2.26/
---
# Django 2.2.26 release notes

*January 4, 2022*

Django 2.2.26 fixes one security issue with severity „medium” and two security
issues with severity „low” in 2.2.25.

## CVE-2021-45115: Denial-of-service possibility in `UserAttributeSimilarityValidator`

[`UserAttributeSimilarityValidator`](/pl/6.0/topics/auth/passwords/#django.contrib.auth.password_validation.UserAttributeSimilarityValidator) incurred significant overhead
evaluating submitted password that were artificially large in relative to the
comparison values. On the assumption that access to user registration was
unrestricted this provided a potential vector for a denial-of-service attack.

In order to mitigate this issue, relatively long values are now ignored by
`UserAttributeSimilarityValidator`.

This issue has severity „medium” according to the [Django security policy](/pl/6.0/internals/security/#severity-levels).

## CVE-2021-45116: Potential information disclosure in `dictsort` template filter

Due to leveraging the Django Template Language’s variable resolution logic, the
[`dictsort`](/pl/6.0/ref/templates/builtins/#std-templatefilter-dictsort) template filter was potentially vulnerable to information
disclosure or unintended method calls, if passed a suitably crafted key.

In order to avoid this possibility, `dictsort` now works with a restricted
resolution logic, that will not call methods, nor allow indexing on
dictionaries.

As a reminder, all untrusted user input should be validated before use.

This issue has severity „low” according to the [Django security policy](/pl/6.0/internals/security/#severity-levels).

## CVE-2021-45452: Potential directory-traversal via `Storage.save()`

`Storage.save()` allowed directory-traversal if directly passed suitably
crafted file names.

This issue has severity „low” according to the [Django security policy](/pl/6.0/internals/security/#severity-levels).