Release note for CVE-2021-29434 in 2.11.7

wagtail · Apr 19, 2021 · d2d4e6e · d2d4e6e
1 parent cbbeae0
commit d2d4e6e
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 0 deletions.
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -1,6 +1,12 @@
 Changelog
 =========
 
+2.11.7 (19.04.2021)
+~~~~~~~~~~~~~~~~~~~
+
+ * Fix: CVE-2021-29434 - fix improper validation of URLs ('Cross-site Scripting') in rich text fields (Kevin Breen, Matt Westcott)
+
+
 2.11.6 (05.03.2021)
 ~~~~~~~~~~~~~~~~~~~
 

diff --git a/docs/releases/2.11.7.rst b/docs/releases/2.11.7.rst
@@ -0,0 +1,18 @@
+============================
+Wagtail 2.11.7 release notes
+============================
+
+.. contents::
+    :local:
+    :depth: 1
+
+
+What's new
+==========
+
+CVE-2021-29434: Improper validation of URLs ('Cross-site Scripting') in rich text fields
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This release addresses a cross-site scripting (XSS) vulnerability in rich text fields. When saving the contents of a rich text field in the admin interface, Wagtail did not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with javascript: URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
+
+Many thanks to Kevin Breen for reporting this issue.
diff --git a/docs/releases/index.rst b/docs/releases/index.rst
@@ -5,6 +5,7 @@ Release notes
    :maxdepth: 1
 
    upgrading
+   2.11.7
    2.11.6
    2.11.5
    2.11.4