We've issued security releases (3.4.3 and 3.3.4) for two medium-level vulnerabilities.
These updates prevent: * a potential escalation of privileges through a django CMS page's Advanced Settings. * a potential phishing attack using redirects from the login form The updated releases are now available from our GitHub repository <https://github.com/divio/django-cms/> and PyPI <https://pypi.python.org/pypi/django-cms/>. Divio Cloud users can update their django CMS installations via the control panel <https://control.divio.com/>. Please see the notes on GitHub <https://github.com/divio/django-cms/issues/5938> for more details. Thanks to Anthony Steinhauser and Mark Walker for the reports. As ever, we remind our users and contributors that all security reports, patches and concerns be addressed only to our security team by email, at <secur...@django-cms.org>. Please do not use GitHub, our email lists or IRC to report, address or otherwise discuss matters relating to security. If you use django CMS in a critically-important application, please contact Divio for details of SLAs, that will give you access to patches and information about vulnerabilities before disclosures or releases are made public: <https://www.divio.com/en/solutions/enterprise-services/>. On behalf of the team, Daniele -- Message URL: https://groups.google.com/d/msg/django-cms-developers/topic-id/message-id Unsubscribe: send a message to django-cms-developers+unsubscr...@googlegroups.com --- You received this message because you are subscribed to the Google Groups "django CMS developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-cms-developers+unsubscr...@googlegroups.com. To view this discussion on the web, visit https://groups.google.com/d/msgid/django-cms-developers/20170426140840.569333035%40mail.gandi.net. For more options, visit https://groups.google.com/d/optout.
