1. ===========================

  2. Django 2.2.27 release notes

  3. ===========================

  4. 

  5. *February 1, 2022*

  6. 

  7. Django 2.2.27 fixes two security issues with severity "medium" in 2.2.26.

  8. 

  9. CVE-2022-22818: Possible XSS via ``{% debug %}`` template tag

  10. =============================================================

  11. 

  12. The ``{% debug %}`` template tag didn't properly encode the current context,

  13. posing an XSS attack vector.

  14. 

  15. In order to avoid this vulnerability, ``{% debug %}`` no longer outputs

  16. information when the ``DEBUG`` setting is ``False``, and it ensures all context

  17. variables are correctly escaped when the ``DEBUG`` setting is ``True``.

  18. 

  19. CVE-2022-23833: Denial-of-service possibility in file uploads

  20. =============================================================

  21. 

  22. Passing certain inputs to multipart forms could result in an infinite loop when

  23. parsing files.
About Sign Up Leave Feedback Contact