mirror of
https://github.com/django/django.git
synced 2024-11-25 07:59:34 +01:00
22 lines
838 B
Plaintext
22 lines
838 B
Plaintext
===========================
|
|
Django 3.1.13 release notes
|
|
===========================
|
|
|
|
*July 1, 2021*
|
|
|
|
Django 3.1.13 fixes a security issue with severity "high" in 3.1.12.
|
|
|
|
CVE-2021-35042: Potential SQL injection via unsanitized ``QuerySet.order_by()`` input
|
|
=====================================================================================
|
|
|
|
Unsanitized user input passed to ``QuerySet.order_by()`` could bypass intended
|
|
column reference validation in path marked for deprecation resulting in a
|
|
potential SQL injection even if a deprecation warning is emitted.
|
|
|
|
As a mitigation the strict column reference validation was restored for the
|
|
duration of the deprecation period. This regression appeared in 3.1 as a side
|
|
effect of fixing :ticket:`31426`.
|
|
|
|
The issue is not present in the main branch as the deprecated path has been
|
|
removed.
|