{"title":"Django 2.2.13 release notes","version":"dev","locale":"en","docname":"releases/2.2.13","url":"/en/dev/releases/2.2.13/","canonical":"https://djangodocs.dev/en/dev/releases/2.2.13/","summary":"Django 2.2.13 fixes two security issues and a regression in 2.2.12. In cases where a memcached backend does not perform key validation, passing malformed…","html":"<h1>Django 2.2.13 release notes<a class=\"heading-anchor\" href=\"#django-2-2-13-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>June 3, 2020</em></p>\n<p>Django 2.2.13 fixes two security issues and a regression in 2.2.12.</p>\n<section id=\"cve-2020-13254-potential-data-leakage-via-malformed-memcached-keys\">\n<h2>CVE-2020-13254: Potential data leakage via malformed memcached keys<a class=\"heading-anchor\" href=\"#cve-2020-13254-potential-data-leakage-via-malformed-memcached-keys\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>In cases where a memcached backend does not perform key validation, passing\nmalformed cache keys could result in a key collision, and potential data\nleakage. In order to avoid this vulnerability, key validation is added to the\nmemcached cache backends.</p>\n</section>\n<section id=\"cve-2020-13596-possible-xss-via-admin-foreignkeyrawidwidget\">\n<h2>CVE-2020-13596: Possible XSS via admin <code class=\"docutils literal notranslate\">ForeignKeyRawIdWidget</code><a class=\"heading-anchor\" href=\"#cve-2020-13596-possible-xss-via-admin-foreignkeyrawidwidget\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Query parameters for the admin <code class=\"docutils literal notranslate\">ForeignKeyRawIdWidget</code> were not properly URL\nencoded, posing an XSS attack vector. <code class=\"docutils literal notranslate\">ForeignKeyRawIdWidget</code> now\nensures query parameters are correctly URL encoded.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a regression in Django 2.2.12 that affected translation loading for\napps providing translations for territorial language variants as well as a\ngeneric language, where the project has different plural equations for the\nlanguage (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/31570\">#31570</a>).</p></li>\n<li><p>Tracking a jQuery security release, upgraded the version of jQuery used by\nthe admin from 3.3.1 to 3.5.1.</p></li>\n</ul>\n</section>","rootId":"django-2-2-13-release-notes","toc":[{"title":"CVE-2020-13254: Potential data leakage via malformed memcached keys","anchor":"cve-2020-13254-potential-data-leakage-via-malformed-memcached-keys","children":[]},{"title":"CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget","anchor":"cve-2020-13596-possible-xss-via-admin-foreignkeyrawidwidget","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/2.2.14","title":"Django 2.2.14 release notes","url":"/en/dev/releases/2.2.14/"},"next":{"docname":"releases/2.2.12","title":"Django 2.2.12 release notes","url":"/en/dev/releases/2.2.12/"},"formats":{"html":"/en/dev/releases/2.2.13/","markdown":"/en/dev/releases/2.2.13.md","json":"/en/dev/releases/2.2.13.json"},"source":"https://github.com/django/django/blob/main/docs/releases/2.2.13.txt","official":"https://docs.djangoproject.com/en/dev/releases/2.2.13/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2"],"inLocales":["en"]}