# changelog

author: yaoxin <yao_xin001@hoperun.com> - 4.2.14-1
changelog:
  - Update to 4.2.14
    * CVE-2024-38875: Potential denial-of-service vulnerability in django.utils.html.urlize()
    * CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords
    * CVE-2024-39330: Potential directory-traversal via Storage.save()
    * CVE-2024-39614: Potential denial-of-service vulnerability in get_supported_language_variant()


author: yaoxin <yao_xin001@hoperun.com> - 4.2.15-1
changelog:
  - Update to 4.2.15
    * CVE-2024-41989: Memory exhaustion in ``django.utils.numberformat.floatformat()``
    * CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
    * CVE-2024-41991: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` and ``AdminURLFieldWidget``
    * CVE-2024-42005: Potential SQL injection in ``QuerySet.values()`` and ``values_list()``
    * Fixed a regression in Django 4.2.14 that caused a crash in ``LocaleMiddleware`` when processing a language code over 500 characters


