{"title":"Archive of security issues","version":"3.0","locale":"en","docname":"releases/security","url":"/en/3.0/releases/security/","canonical":"https://djangodocs.dev/en/3.0/releases/security/","summary":"Django’s development team is strongly committed to responsible reporting and disclosure of security-related issues, as outlined in Django’s security policies . As…","html":"

Archive of security issuesLink to this heading#

\n

Django’s development team is strongly committed to responsible\nreporting and disclosure of security-related issues, as outlined in\nDjango’s security policies.

\n

As part of that commitment, we maintain the following historical list\nof issues which have been fixed and disclosed. For each issue, the\nlist below includes the date, a brief description, the CVE identifier\nif applicable, a list of affected versions, a link to the full\ndisclosure and links to the appropriate patch(es).

\n

Some important caveats apply to this information:

\n\n
\n

Issues prior to Django’s security processLink to this heading#

\n

Some security issues were handled before Django had a formalized\nsecurity process in use. For these, new releases may not have been\nissued at the time and CVEs may not have been assigned.

\n
\n

August 16, 2006 - CVE 2007-0404Link to this heading#

\n

Filename validation issue in translation framework. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 21, 2007 - CVE 2007-0405Link to this heading#

\n

Apparent “caching” of authenticated user. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n
\n

Issues under Django’s security processLink to this heading#

\n

All other security issues have been handled under versions of Django’s\nsecurity process. These are listed below.

\n
\n

October 26, 2007 - CVE 2007-5712Link to this heading#

\n

Denial-of-service via arbitrarily-large Accept-Language header. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 14, 2008 - CVE 2008-2302Link to this heading#

\n

XSS via admin login redirect. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 2, 2008 - CVE 2008-3909Link to this heading#

\n

CSRF via preservation of POST data during admin login. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 28, 2009 - CVE 2009-2659Link to this heading#

\n

Directory-traversal in development server media handler. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

October 9, 2009 - CVE 2009-3965Link to this heading#

\n

Denial-of-service via pathological regular expression performance. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 8, 2010 - CVE 2010-3082Link to this heading#

\n

XSS via trusting unsafe cookie value. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 22, 2010 - CVE 2010-4534Link to this heading#

\n

Information leakage in administrative interface. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 22, 2010 - CVE 2010-4535Link to this heading#

\n

Denial-of-service in password-reset mechanism. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0696Link to this heading#

\n

CSRF via forged HTTP headers. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0697Link to this heading#

\n

XSS via unsanitized names of uploaded files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0698Link to this heading#

\n

Directory-traversal on Windows via incorrect path-separator handling. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4136Link to this heading#

\n

Session manipulation when using memory-cache-backed session. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4137Link to this heading#

\n

Denial-of-service via URLField.verify_exists. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4138Link to this heading#

\n

Information leakage/arbitrary request issuance via URLField.verify_exists.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4139Link to this heading#

\n

Host header cache poisoning. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4140Link to this heading#

\n

Potential CSRF via Host header. Full description

\n
\n

Versions affectedLink to this heading#

\n

This notification was an advisory only, so no patches were issued.

\n
    \n

  • Django 1.2

    • \n

  • Django 1.3

    • \n
\n
\n
\n
\n

July 30, 2012 - CVE 2012-3442Link to this heading#

\n

XSS via failure to validate redirect scheme. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3443Link to this heading#

\n

Denial-of-service via compressed image files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3444Link to this heading#

\n

Denial-of-service via large image files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

October 17, 2012 - CVE 2012-4520Link to this heading#

\n

Host header poisoning. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 10, 2012 - No CVE 1Link to this heading#

\n

Additional hardening of Host header handling. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 10, 2012 - No CVE 2Link to this heading#

\n

Additional hardening of redirect validation. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - No CVELink to this heading#

\n

Additional hardening of Host header handling. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-1664 / CVE 2013-1665Link to this heading#

\n

Entity-based attacks against Python XML libraries. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-0305Link to this heading#

\n

Information leakage via admin history log. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-0306Link to this heading#

\n

Denial-of-service via formset max_num bypass. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 13, 2013 - CVE 2013-4249Link to this heading#

\n

XSS via admin trusting URLField values. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 13, 2013 - CVE 2013-6044Link to this heading#

\n

Possible XSS via unvalidated URL redirect schemes. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 10, 2013 - CVE 2013-4315Link to this heading#

\n

Directory-traversal via ssi template tag. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 14, 2013 - CVE 2013-1443Link to this heading#

\n

Denial-of-service via large passwords. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0472Link to this heading#

\n

Unexpected code execution using reverse(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0473Link to this heading#

\n

Caching of anonymous pages could reveal CSRF token. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0474Link to this heading#

\n

MySQL typecasting causes unexpected query results. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 18, 2014 - CVE 2014-1418Link to this heading#

\n

Caches may be allowed to store and serve private data. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 18, 2014 - CVE 2014-3730Link to this heading#

\n

Malformed URLs from user input incorrectly validated. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0480Link to this heading#

\n

reverse() can generate URLs pointing to other hosts. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0481Link to this heading#

\n

File upload denial of service. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0482Link to this heading#

\n

RemoteUserMiddleware session hijacking. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0483Link to this heading#

\n

Data leakage via querystring manipulation in admin.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0219Link to this heading#

\n

WSGI header spoofing via underscore/dash conflation. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0220Link to this heading#

\n

Mitigated possible XSS attack via user-supplied redirect URLs. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0221Link to this heading#

\n

Denial-of-service attack against django.views.static.serve(). Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0222Link to this heading#

\n

Database denial-of-service with ModelMultipleChoiceField. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 9, 2015 - CVE 2015-2241Link to this heading#

\n

XSS attack via properties in ModelAdmin.readonly_fields. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 18, 2015 - CVE 2015-2316Link to this heading#

\n

Denial-of-service possibility with strip_tags(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 18, 2015 - CVE 2015-2317Link to this heading#

\n

Mitigated possible XSS attack via user-supplied redirect URLs. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 20, 2015 - CVE 2015-3982Link to this heading#

\n

Fixed session flushing in the cached_db backend. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5143Link to this heading#

\n

Denial-of-service possibility by filling session store. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5144Link to this heading#

\n

Header injection possibility since validators accept newlines in input. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5145Link to this heading#

\n

Denial-of-service possibility in URL validation. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 18, 2015 - CVE 2015-5963 / CVE 2015-5964Link to this heading#

\n

Denial-of-service possibility in logout() view by filling session store.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

November 24, 2015 - CVE 2015-8213Link to this heading#

\n

Settings leak possibility in date template filter. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 1, 2016 - CVE 2016-2048Link to this heading#

\n

User with “change” but not “add” permission can create objects for\nModelAdmin’s with save_as=True. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 1, 2016 - CVE 2016-2512Link to this heading#

\n

Malicious redirect and possible XSS attack via user-supplied redirect URLs\ncontaining basic auth. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 1, 2016 - CVE 2016-2513Link to this heading#

\n

User enumeration through timing difference on password hasher work factor\nupgrade. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 18, 2016 - CVE 2016-6186Link to this heading#

\n

XSS in admin’s add/change related popup. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 26, 2016 - CVE 2016-7401Link to this heading#

\n

CSRF protection bypass on a site with Google Analytics. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

November 1, 2016 - CVE 2016-9013Link to this heading#

\n

User with hardcoded password created when running tests on Oracle. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

November 1, 2016 - CVE 2016-9014Link to this heading#

\n

DNS rebinding vulnerability when DEBUG=True. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 4, 2017 - CVE 2017-7233Link to this heading#

\n

Open redirect and possible XSS attack via user-supplied numeric redirect URLs.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 4, 2017 - CVE 2017-7234Link to this heading#

\n

Open redirect vulnerability in django.views.static.serve(). Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 5, 2017 - CVE 2017-12794Link to this heading#

\n

Possible XSS in traceback section of technical 500 debug page. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 1, 2018 - CVE 2018-6188Link to this heading#

\n

Information leakage in AuthenticationForm. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 6, 2018 - CVE 2018-7536Link to this heading#

\n

Denial-of-service possibility in urlize and urlizetrunc template\nfilters. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 6, 2018 - CVE 2018-7537Link to this heading#

\n

Denial-of-service possibility in truncatechars_html and\ntruncatewords_html template filters. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2018 - CVE 2018-14574Link to this heading#

\n

Open redirect possibility in CommonMiddleware. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

October 1, 2018 - CVE 2018-16984Link to this heading#

\n

Password hash disclosure to “view only” admin users. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 4, 2019 - CVE 2019-3498Link to this heading#

\n

Content spoofing possibility in the default 404 page. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 11, 2019 - CVE 2019-6975Link to this heading#

\n

Memory exhaustion in django.utils.numberformat.format(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 3, 2019 - CVE 2019-11358Link to this heading#

\n

Prototype pollution in bundled jQuery. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 3, 2019 - CVE 2019-12308Link to this heading#

\n

XSS via “Current URL” link generated by AdminURLFieldWidget. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 1, 2019 - CVE 2019-12781Link to this heading#

\n

Incorrect HTTP detection with reverse-proxy connecting via HTTPS. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14232Link to this heading#

\n

Denial-of-service possibility in django.utils.text.Truncator. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14233Link to this heading#

\n

Denial-of-service possibility in strip_tags(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14234Link to this heading#

\n

SQL injection possibility in key and index lookups for\nJSONField/HStoreField. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14235Link to this heading#

\n

Potential memory exhaustion in django.utils.encoding.uri_to_iri(). Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 2, 2019 - CVE 2019-19118Link to this heading#

\n

Privilege escalation in the Django admin. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 18, 2019 - CVE 2019-19844Link to this heading#

\n

Potential account hijack via password reset form. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 3, 2020 - CVE 2020-7471Link to this heading#

\n

Potential SQL injection via StringAgg(delimiter). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 4, 2020 - CVE 2020-9402Link to this heading#

\n

Potential SQL injection via tolerance parameter in GIS functions and\naggregates on Oracle. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 3, 2020 - CVE 2020-13254Link to this heading#

\n

Potential data leakage via malformed memcached keys. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 3, 2020 - CVE 2020-13596Link to this heading#

\n

Possible XSS via admin ForeignKeyRawIdWidget. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 1, 2020 - CVE 2020-24583Link to this heading#

\n

Incorrect permissions on intermediate-level directories on Python 3.7+. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 1, 2020 - CVE 2020-24584Link to this heading#

\n

Permission escalation in intermediate-level directories of the file system\ncache on Python 3.7+. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 1, 2021 - CVE 2021-3281Link to this heading#

\n

Potential directory-traversal via archive.extract(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2021 - CVE 2021-23336Link to this heading#

\n

Web cache poisoning via django.utils.http.limited_parse_qsl(). Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 6, 2021 - CVE 2021-28658Link to this heading#

\n

Potential directory-traversal via uploaded files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
","rootId":"archive-of-security-issues","toc":[{"title":"Issues prior to Django’s security process","anchor":"issues-prior-to-django-s-security-process","children":[{"title":"August 16, 2006 - CVE 2007-0404","anchor":"august-16-2006-cve-2007-0404","children":[{"title":"Versions affected","anchor":"versions-affected","children":[]}]},{"title":"January 21, 2007 - CVE 2007-0405","anchor":"january-21-2007-cve-2007-0405","children":[{"title":"Versions affected","anchor":"id1","children":[]}]}]},{"title":"Issues under Django’s security process","anchor":"issues-under-django-s-security-process","children":[{"title":"October 26, 2007 - CVE 2007-5712","anchor":"october-26-2007-cve-2007-5712","children":[{"title":"Versions affected","anchor":"id2","children":[]}]},{"title":"May 14, 2008 - CVE 2008-2302","anchor":"may-14-2008-cve-2008-2302","children":[{"title":"Versions affected","anchor":"id3","children":[]}]},{"title":"September 2, 2008 - CVE 2008-3909","anchor":"september-2-2008-cve-2008-3909","children":[{"title":"Versions affected","anchor":"id4","children":[]}]},{"title":"July 28, 2009 - CVE 2009-2659","anchor":"july-28-2009-cve-2009-2659","children":[{"title":"Versions affected","anchor":"id5","children":[]}]},{"title":"October 9, 2009 - CVE 2009-3965","anchor":"october-9-2009-cve-2009-3965","children":[{"title":"Versions affected","anchor":"id6","children":[]}]},{"title":"September 8, 2010 - CVE 2010-3082","anchor":"september-8-2010-cve-2010-3082","children":[{"title":"Versions affected","anchor":"id7","children":[]}]},{"title":"December 22, 2010 - CVE 2010-4534","anchor":"december-22-2010-cve-2010-4534","children":[{"title":"Versions affected","anchor":"id8","children":[]}]},{"title":"December 22, 2010 - CVE 2010-4535","anchor":"december-22-2010-cve-2010-4535","children":[{"title":"Versions affected","anchor":"id9","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0696","anchor":"february-8-2011-cve-2011-0696","children":[{"title":"Versions affected","anchor":"id10","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0697","anchor":"february-8-2011-cve-2011-0697","children":[{"title":"Versions affected","anchor":"id11","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0698","anchor":"february-8-2011-cve-2011-0698","children":[{"title":"Versions affected","anchor":"id12","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4136","anchor":"september-9-2011-cve-2011-4136","children":[{"title":"Versions affected","anchor":"id13","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4137","anchor":"september-9-2011-cve-2011-4137","children":[{"title":"Versions affected","anchor":"id14","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4138","anchor":"september-9-2011-cve-2011-4138","children":[{"title":"Versions affected","anchor":"id15","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4139","anchor":"september-9-2011-cve-2011-4139","children":[{"title":"Versions affected","anchor":"id16","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4140","anchor":"september-9-2011-cve-2011-4140","children":[{"title":"Versions affected","anchor":"id17","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3442","anchor":"july-30-2012-cve-2012-3442","children":[{"title":"Versions affected","anchor":"id18","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3443","anchor":"july-30-2012-cve-2012-3443","children":[{"title":"Versions affected","anchor":"id19","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3444","anchor":"july-30-2012-cve-2012-3444","children":[{"title":"Versions affected","anchor":"id20","children":[]}]},{"title":"October 17, 2012 - CVE 2012-4520","anchor":"october-17-2012-cve-2012-4520","children":[{"title":"Versions affected","anchor":"id21","children":[]}]},{"title":"December 10, 2012 - No CVE 1","anchor":"december-10-2012-no-cve-1","children":[{"title":"Versions affected","anchor":"id22","children":[]}]},{"title":"December 10, 2012 - No CVE 2","anchor":"december-10-2012-no-cve-2","children":[{"title":"Versions affected","anchor":"id23","children":[]}]},{"title":"February 19, 2013 - No CVE","anchor":"february-19-2013-no-cve","children":[{"title":"Versions affected","anchor":"id24","children":[]}]},{"title":"February 19, 2013 - CVE 2013-1664 / CVE 2013-1665","anchor":"february-19-2013-cve-2013-1664-cve-2013-1665","children":[{"title":"Versions affected","anchor":"id25","children":[]}]},{"title":"February 19, 2013 - CVE 2013-0305","anchor":"february-19-2013-cve-2013-0305","children":[{"title":"Versions affected","anchor":"id26","children":[]}]},{"title":"February 19, 2013 - CVE 2013-0306","anchor":"february-19-2013-cve-2013-0306","children":[{"title":"Versions affected","anchor":"id27","children":[]}]},{"title":"August 13, 2013 - CVE 2013-4249","anchor":"august-13-2013-cve-2013-4249","children":[{"title":"Versions affected","anchor":"id28","children":[]}]},{"title":"August 13, 2013 - CVE 2013-6044","anchor":"august-13-2013-cve-2013-6044","children":[{"title":"Versions affected","anchor":"id29","children":[]}]},{"title":"September 10, 2013 - CVE 2013-4315","anchor":"september-10-2013-cve-2013-4315","children":[{"title":"Versions affected","anchor":"id30","children":[]}]},{"title":"September 14, 2013 - CVE 2013-1443","anchor":"september-14-2013-cve-2013-1443","children":[{"title":"Versions affected","anchor":"id31","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0472","anchor":"april-21-2014-cve-2014-0472","children":[{"title":"Versions affected","anchor":"id32","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0473","anchor":"april-21-2014-cve-2014-0473","children":[{"title":"Versions affected","anchor":"id33","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0474","anchor":"april-21-2014-cve-2014-0474","children":[{"title":"Versions affected","anchor":"id34","children":[]}]},{"title":"May 18, 2014 - CVE 2014-1418","anchor":"may-18-2014-cve-2014-1418","children":[{"title":"Versions affected","anchor":"id35","children":[]}]},{"title":"May 18, 2014 - CVE 2014-3730","anchor":"may-18-2014-cve-2014-3730","children":[{"title":"Versions affected","anchor":"id36","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0480","anchor":"august-20-2014-cve-2014-0480","children":[{"title":"Versions affected","anchor":"id37","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0481","anchor":"august-20-2014-cve-2014-0481","children":[{"title":"Versions affected","anchor":"id38","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0482","anchor":"august-20-2014-cve-2014-0482","children":[{"title":"Versions affected","anchor":"id39","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0483","anchor":"august-20-2014-cve-2014-0483","children":[{"title":"Versions affected","anchor":"id40","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0219","anchor":"january-13-2015-cve-2015-0219","children":[{"title":"Versions affected","anchor":"id41","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0220","anchor":"january-13-2015-cve-2015-0220","children":[{"title":"Versions affected","anchor":"id42","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0221","anchor":"january-13-2015-cve-2015-0221","children":[{"title":"Versions affected","anchor":"id43","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0222","anchor":"january-13-2015-cve-2015-0222","children":[{"title":"Versions affected","anchor":"id44","children":[]}]},{"title":"March 9, 2015 - CVE 2015-2241","anchor":"march-9-2015-cve-2015-2241","children":[{"title":"Versions affected","anchor":"id45","children":[]}]},{"title":"March 18, 2015 - CVE 2015-2316","anchor":"march-18-2015-cve-2015-2316","children":[{"title":"Versions affected","anchor":"id46","children":[]}]},{"title":"March 18, 2015 - CVE 2015-2317","anchor":"march-18-2015-cve-2015-2317","children":[{"title":"Versions affected","anchor":"id47","children":[]}]},{"title":"May 20, 2015 - CVE 2015-3982","anchor":"may-20-2015-cve-2015-3982","children":[{"title":"Versions affected","anchor":"id48","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5143","anchor":"july-8-2015-cve-2015-5143","children":[{"title":"Versions affected","anchor":"id49","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5144","anchor":"july-8-2015-cve-2015-5144","children":[{"title":"Versions affected","anchor":"id50","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5145","anchor":"july-8-2015-cve-2015-5145","children":[{"title":"Versions affected","anchor":"id51","children":[]}]},{"title":"August 18, 2015 - CVE 2015-5963 / CVE 2015-5964","anchor":"august-18-2015-cve-2015-5963-cve-2015-5964","children":[{"title":"Versions affected","anchor":"id52","children":[]}]},{"title":"November 24, 2015 - CVE 2015-8213","anchor":"november-24-2015-cve-2015-8213","children":[{"title":"Versions affected","anchor":"id53","children":[]}]},{"title":"February 1, 2016 - CVE 2016-2048","anchor":"february-1-2016-cve-2016-2048","children":[{"title":"Versions affected","anchor":"id54","children":[]}]},{"title":"March 1, 2016 - CVE 2016-2512","anchor":"march-1-2016-cve-2016-2512","children":[{"title":"Versions affected","anchor":"id55","children":[]}]},{"title":"March 1, 2016 - CVE 2016-2513","anchor":"march-1-2016-cve-2016-2513","children":[{"title":"Versions affected","anchor":"id56","children":[]}]},{"title":"July 18, 2016 - CVE 2016-6186","anchor":"july-18-2016-cve-2016-6186","children":[{"title":"Versions affected","anchor":"id57","children":[]}]},{"title":"September 26, 2016 - CVE 2016-7401","anchor":"september-26-2016-cve-2016-7401","children":[{"title":"Versions affected","anchor":"id58","children":[]}]},{"title":"November 1, 2016 - CVE 2016-9013","anchor":"november-1-2016-cve-2016-9013","children":[{"title":"Versions affected","anchor":"id59","children":[]}]},{"title":"November 1, 2016 - CVE 2016-9014","anchor":"november-1-2016-cve-2016-9014","children":[{"title":"Versions affected","anchor":"id60","children":[]}]},{"title":"April 4, 2017 - CVE 2017-7233","anchor":"april-4-2017-cve-2017-7233","children":[{"title":"Versions affected","anchor":"id61","children":[]}]},{"title":"April 4, 2017 - CVE 2017-7234","anchor":"april-4-2017-cve-2017-7234","children":[{"title":"Versions affected","anchor":"id62","children":[]}]},{"title":"September 5, 2017 - CVE 2017-12794","anchor":"september-5-2017-cve-2017-12794","children":[{"title":"Versions affected","anchor":"id63","children":[]}]},{"title":"February 1, 2018 - CVE 2018-6188","anchor":"february-1-2018-cve-2018-6188","children":[{"title":"Versions affected","anchor":"id64","children":[]}]},{"title":"March 6, 2018 - CVE 2018-7536","anchor":"march-6-2018-cve-2018-7536","children":[{"title":"Versions affected","anchor":"id65","children":[]}]},{"title":"March 6, 2018 - CVE 2018-7537","anchor":"march-6-2018-cve-2018-7537","children":[{"title":"Versions affected","anchor":"id66","children":[]}]},{"title":"August 1, 2018 - CVE 2018-14574","anchor":"august-1-2018-cve-2018-14574","children":[{"title":"Versions affected","anchor":"id67","children":[]}]},{"title":"October 1, 2018 - CVE 2018-16984","anchor":"october-1-2018-cve-2018-16984","children":[{"title":"Versions affected","anchor":"id68","children":[]}]},{"title":"January 4, 2019 - CVE 2019-3498","anchor":"january-4-2019-cve-2019-3498","children":[{"title":"Versions affected","anchor":"id69","children":[]}]},{"title":"February 11, 2019 - CVE 2019-6975","anchor":"february-11-2019-cve-2019-6975","children":[{"title":"Versions affected","anchor":"id70","children":[]}]},{"title":"June 3, 2019 - CVE 2019-11358","anchor":"june-3-2019-cve-2019-11358","children":[{"title":"Versions affected","anchor":"id71","children":[]}]},{"title":"June 3, 2019 - CVE 2019-12308","anchor":"june-3-2019-cve-2019-12308","children":[{"title":"Versions affected","anchor":"id72","children":[]}]},{"title":"July 1, 2019 - CVE 2019-12781","anchor":"july-1-2019-cve-2019-12781","children":[{"title":"Versions affected","anchor":"id73","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14232","anchor":"august-1-2019-cve-2019-14232","children":[{"title":"Versions affected","anchor":"id74","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14233","anchor":"august-1-2019-cve-2019-14233","children":[{"title":"Versions affected","anchor":"id75","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14234","anchor":"august-1-2019-cve-2019-14234","children":[{"title":"Versions affected","anchor":"id76","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14235","anchor":"august-1-2019-cve-2019-14235","children":[{"title":"Versions affected","anchor":"id77","children":[]}]},{"title":"December 2, 2019 - CVE 2019-19118","anchor":"december-2-2019-cve-2019-19118","children":[{"title":"Versions affected","anchor":"id78","children":[]}]},{"title":"December 18, 2019 - CVE 2019-19844","anchor":"december-18-2019-cve-2019-19844","children":[{"title":"Versions affected","anchor":"id79","children":[]}]},{"title":"February 3, 2020 - CVE 2020-7471","anchor":"february-3-2020-cve-2020-7471","children":[{"title":"Versions affected","anchor":"id80","children":[]}]},{"title":"March 4, 2020 - CVE 2020-9402","anchor":"march-4-2020-cve-2020-9402","children":[{"title":"Versions affected","anchor":"id81","children":[]}]},{"title":"June 3, 2020 - CVE 2020-13254","anchor":"june-3-2020-cve-2020-13254","children":[{"title":"Versions affected","anchor":"id82","children":[]}]},{"title":"June 3, 2020 - CVE 2020-13596","anchor":"june-3-2020-cve-2020-13596","children":[{"title":"Versions affected","anchor":"id83","children":[]}]},{"title":"September 1, 2020 - CVE 2020-24583","anchor":"september-1-2020-cve-2020-24583","children":[{"title":"Versions affected","anchor":"id84","children":[]}]},{"title":"September 1, 2020 - CVE 2020-24584","anchor":"september-1-2020-cve-2020-24584","children":[{"title":"Versions affected","anchor":"id85","children":[]}]},{"title":"February 1, 2021 - CVE 2021-3281","anchor":"february-1-2021-cve-2021-3281","children":[{"title":"Versions affected","anchor":"id86","children":[]}]},{"title":"February 19, 2021 - CVE 2021-23336","anchor":"february-19-2021-cve-2021-23336","children":[{"title":"Versions affected","anchor":"id87","children":[]}]},{"title":"April 6, 2021 - CVE 2021-28658","anchor":"april-6-2021-cve-2021-28658","children":[{"title":"Versions affected","anchor":"id88","children":[]}]}]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/3.0/releases/"}],"prev":{"docname":"releases/0.95","title":"Django version 0.95 release notes","url":"/en/3.0/releases/0.95/"},"next":{"docname":"internals/index","title":"Django internals","url":"/en/3.0/internals/"},"formats":{"html":"/en/3.0/releases/security/","markdown":"/en/3.0/releases/security.md","json":"/en/3.0/releases/security.json"},"source":"https://github.com/django/django/blob/stable/3.0.x/docs/releases/security.txt","official":"https://docs.djangoproject.com/en/3.0/releases/security/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en","zh-hans","fr","ja","id","pt-br","ko","es","el","pl"]}