{"title":"Django 1.5.3 release notes","version":"dev","locale":"en","docname":"releases/1.5.3","url":"/en/dev/releases/1.5.3/","canonical":"https://djangodocs.dev/en/dev/releases/1.5.3/","summary":"This is Django 1.5.3, the third release in the Django 1.5 series. It addresses one security issue and also contains an opt-in feature to enhance the…","html":"

Django 1.5.3 release notesLink to this heading#

\n

September 10, 2013

\n

This is Django 1.5.3, the third release in the Django 1.5 series. It addresses\none security issue and also contains an opt-in feature to enhance the security\nof django.contrib.sessions.

\n
\n

Directory traversal vulnerability in ssi template tagLink to this heading#

\n

In previous versions of Django it was possible to bypass the\nALLOWED_INCLUDE_ROOTS setting used for security with the ssi\ntemplate tag by specifying a relative path that starts with one of the allowed\nroots. For example, if ALLOWED_INCLUDE_ROOTS = ("/var/www",) the following\nwould be possible:

\n
Django template
{% ssi "/var/www/../../etc/passwd" %}\n
\n

In practice this is not a very common problem, as it would require the template\nauthor to put the ssi file in a user-controlled variable, but it’s possible\nin principle.

\n
\n
\n

Mitigating a remote-code execution vulnerability in django.contrib.sessionsLink to this heading#

\n

django.contrib.sessions currently uses pickle to serialize\nsession data before storing it in the backend. If you’re using the signed\ncookie session backend and SECRET_KEY is\nknown by an attacker (there isn’t an inherent vulnerability in Django that\nwould cause it to leak), the attacker could insert a string into their session\nwhich, when unpickled, executes arbitrary code on the server. The technique for\ndoing so is simple and easily available on the internet. Although the cookie\nsession storage signs the cookie-stored data to prevent tampering, a\nSECRET_KEY leak immediately escalates to a remote code execution\nvulnerability.

\n

This attack can be mitigated by serializing session data using JSON rather\nthan pickle. To facilitate this, Django 1.5.3 introduces a new setting,\nSESSION_SERIALIZER, to customize the session serialization format.\nFor backwards compatibility, this setting defaults to using pickle.\nWhile JSON serialization does not support all Python objects like pickle\ndoes, we highly recommend switching to JSON-serialized values. Also,\nas JSON requires string keys, you will likely run into problems if you are\nusing non-string keys in request.session. See the\nSession serialization documentation for more details.

\n
","rootId":"django-1-5-3-release-notes","toc":[{"title":"Directory traversal vulnerability in ssi template tag","anchor":"directory-traversal-vulnerability-in-ssi-template-tag","children":[]},{"title":"Mitigating a remote-code execution vulnerability in django.contrib.sessions","anchor":"mitigating-a-remote-code-execution-vulnerability-in-django-contrib-sessions","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.5.4","title":"Django 1.5.4 release notes","url":"/en/dev/releases/1.5.4/"},"next":{"docname":"releases/1.5.2","title":"Django 1.5.2 release notes","url":"/en/dev/releases/1.5.2/"},"formats":{"html":"/en/dev/releases/1.5.3/","markdown":"/en/dev/releases/1.5.3.md","json":"/en/dev/releases/1.5.3.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.5.3.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.5.3/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}