{"title":"Django 1.8.3 release notes","version":"dev","locale":"en","docname":"releases/1.8.3","url":"/en/dev/releases/1.8.3/","canonical":"https://djangodocs.dev/en/dev/releases/1.8.3/","summary":"Django 1.8.3 fixes several security issues and bugs in 1.8.2. Also, django.utils.deprecation.RemovedInDjango20Warning was renamed to RemovedInDjango110Warnin…","html":"

Django 1.8.3 release notesLink to this heading#

\n

July 8, 2015

\n

Django 1.8.3 fixes several security issues and bugs in 1.8.2.

\n

Also, django.utils.deprecation.RemovedInDjango20Warning was renamed to\nRemovedInDjango110Warning as the version roadmap was revised to 1.9, 1.10,\n1.11 (LTS), 2.0 (drops Python 2 support). For backwards compatibility,\nRemovedInDjango20Warning remains as an importable alias.

\n
\n

Denial-of-service possibility by filling session storeLink to this heading#

\n

In previous versions of Django, the session backends created a new empty record\nin the session storage anytime request.session was accessed and there was a\nsession key provided in the request cookies that didn’t already have a session\nrecord. This could allow an attacker to easily create many new session records\nsimply by sending repeated requests with unknown session keys, potentially\nfilling up the session store or causing other users’ session records to be\nevicted.

\n

The built-in session backends now create a session record only if the session\nis actually modified; empty session records are not created. Thus this\npotential DoS is now only possible if the site chooses to expose a\nsession-modifying view to anonymous users.

\n

As each built-in session backend was fixed separately (rather than a fix in the\ncore sessions framework), maintainers of third-party session backends should\ncheck whether the same vulnerability is present in their backend and correct\nit if so.

\n
\n
\n

Header injection possibility since validators accept newlines in inputLink to this heading#

\n

Some of Django’s built-in validators\n(EmailValidator, most seriously) didn’t\nprohibit newline characters (due to the usage of $ instead of \\Z in the\nregular expressions). If you use values with newlines in HTTP response or email\nheaders, you can suffer from header injection attacks. Django itself isn’t\nvulnerable because HttpResponse and the mail sending\nutilities in django.core.mail prohibit newlines in HTTP and SMTP\nheaders, respectively. While the validators have been fixed in Django, if\nyou’re creating HTTP responses or email messages in other ways, it’s a good\nidea to ensure that those methods prohibit newlines as well. You might also\nwant to validate that any existing data in your application doesn’t contain\nunexpected newlines.

\n

validate_ipv4_address(),\nvalidate_slug(), and\nURLValidator are also affected, however, as\nof Django 1.6 the GenericIPAddresseField, IPAddressField,\nSlugField, and URLField form fields which use these validators all\nstrip the input, so the possibility of newlines entering your data only exists\nif you are using these validators outside of the form fields.

\n

The undocumented, internally unused validate_integer() function is now\nstricter as it validates using a regular expression instead of simply casting\nthe value using int() and checking if an exception was raised.

\n
\n
\n

Denial-of-service possibility in URL validationLink to this heading#

\n

URLValidator included a regular expression\nthat was extremely slow to evaluate against certain invalid inputs. This\nregular expression has been simplified and optimized.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-1-8-3-release-notes","toc":[{"title":"Denial-of-service possibility by filling session store","anchor":"denial-of-service-possibility-by-filling-session-store","children":[]},{"title":"Header injection possibility since validators accept newlines in input","anchor":"header-injection-possibility-since-validators-accept-newlines-in-input","children":[]},{"title":"Denial-of-service possibility in URL validation","anchor":"denial-of-service-possibility-in-url-validation","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.8.4","title":"Django 1.8.4 release notes","url":"/en/dev/releases/1.8.4/"},"next":{"docname":"releases/1.8.2","title":"Django 1.8.2 release notes","url":"/en/dev/releases/1.8.2/"},"formats":{"html":"/en/dev/releases/1.8.3/","markdown":"/en/dev/releases/1.8.3.md","json":"/en/dev/releases/1.8.3.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.8.3.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.8.3/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}