Context Navigation

Changes between Version 29 and Version 30 of SecurityTeam

-              v29
+              v30
 [1] https://docs.djangoproject.com/en/stable/howto/auth-remote-user/#configuration
+=== Session fixation issue in password reset token ===
+Hello,
+Thank you for your report.
+After review, based on the scenario described, this does not constitute a security vulnerability in Django. The attack relies on the application first introducing a session fixation condition by accepting or setting a user controlled session id. Issues that depend on an application allowing arbitrary session fixation fall outside Django's security policy.
+If there is interest in discussing whether the password reset flow could be further hardened in environments where a session is already compromised, that would be better handled as a public ticket so it can be discussed through the normal development process.
+Kind regards, The Django Security Team.
 === Confusion with YANGO (usually sent in Spanish) ===