Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is it possible to apply a security patch to version 3.14? #9569

Open
SorianoMarmol opened this issue Oct 21, 2024 · 0 comments
Open

Is it possible to apply a security patch to version 3.14? #9569

SorianoMarmol opened this issue Oct 21, 2024 · 0 comments

Comments

@SorianoMarmol
Copy link

SorianoMarmol commented Oct 21, 2024

Hello,

First of all, thank you very much for your work and effort.

I was wondering if it would be possible to cherry-pick the following commit (from this PR) to the version 3.14. It is a fairly simple fix for a potential security risk (reported by dependabot, moderate severity 6.1/10):

Cross-site Scripting in djangorestframework
Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with
tags.

With version 3.15, significant design changes have been introduced that require considerable time to update. So cherry-picking this commit to address this potential security issue would help many projects by giving them more time to update smoothly.

I’d like to take the opportunity to point out that version 3.15.2 does not appear in the release list with its changelog, but it is available on Pypi.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant