# changelog

author: wenxin<wenxin32@foxmail.com> - v1.4.1-3
changelog:
  - fix the query error of cve associated host
  - update verification method for host ip fieldl;fix repo field filter error
  - update TimedCorrectTask method


author: wangkai <13474090681@163.com> - 3.18.0-13
changelog:
  - Fix CVE-2020-24292 CVE-2020-24293 CVE-2020-24295 CVE-2021-33367
    CVE-2021-40263 CVE-2021-40266 CVE-2023-47995 CVE-2023-47997


author: yaoxin <yao_xin001@hoperun.com> - 5.0.0-1
changelog:
  - Update to 5.0.0:
    * Breaking: Change default to disable private network access
      This effectively resolves GHSA-hxwh-jpp2-84pm https://osv.dev/vulnerability/PYSEC-2024-71


author: yaoxin <yao_xin001@hoperun.com> - 4.2.14-1
changelog:
  - Update to 4.2.14
    * CVE-2024-38875: Potential denial-of-service vulnerability in django.utils.html.urlize()
    * CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords
    * CVE-2024-39330: Potential directory-traversal via Storage.save()
    * CVE-2024-39614: Potential denial-of-service vulnerability in get_supported_language_variant()


author: yaoxin <yao_xin001@hoperun.com> - 4.2.15-1
changelog:
  - Update to 4.2.15
    * CVE-2024-41989: Memory exhaustion in ``django.utils.numberformat.floatformat()``
    * CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
    * CVE-2024-41991: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` and ``AdminURLFieldWidget``
    * CVE-2024-42005: Potential SQL injection in ``QuerySet.values()`` and ``values_list()``
    * Fixed a regression in Django 4.2.14 that caused a crash in ``LocaleMiddleware`` when processing a language code over 500 characters


author: huayadong <huayadong@kylinos.cn> - 3.1.2-24
changelog:
  - Type:bugfix
  - ID:#I7WGWQ
  - SUG:NA
  - DESC:fix Abnormal information during installation and uninstallation


author: peijiankang <peijiankang@kylinos.cn> - 3.1.2-27
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: add add-information-for-about.patch cpuinfo-in-arm-system-is-null.patch add-ukcc-setlang.patch fix-changeusertype-error.patch


author: peijiankang <peijiankang@kylinos.cn> - 3.1.2-31
changelog:
  - Type:bugfix
  - ID  :NA
  - SUG :NA
  - DESC:add ukui-control-center-3.1.2-repair-freelogin-autologin-not-available.patch


author: tangjie02 <tangjie02@kylinsec.com.cn> - 1.2.15-5
changelog:
  - if the output directory does not exist, it will be created automatically.
  - fix the pointer position update error after enviroment variable is replaced. 
  - ignore the rule when the environment in %E(env) isn't found.


