{"title":"Django 3.0.7 release notes","version":"dev","locale":"en","docname":"releases/3.0.7","url":"/en/dev/releases/3.0.7/","canonical":"https://djangodocs.dev/en/dev/releases/3.0.7/","summary":"Django 3.0.7 fixes two security issues and several bugs in 3.0.6. In cases where a memcached backend does not perform key validation, passing malformed…","html":"<h1>Django 3.0.7 release notes<a class=\"heading-anchor\" href=\"#django-3-0-7-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>June 3, 2020</em></p>\n<p>Django 3.0.7 fixes two security issues and several bugs in 3.0.6.</p>\n<section id=\"cve-2020-13254-potential-data-leakage-via-malformed-memcached-keys\">\n<h2>CVE-2020-13254: Potential data leakage via malformed memcached keys<a class=\"heading-anchor\" href=\"#cve-2020-13254-potential-data-leakage-via-malformed-memcached-keys\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>In cases where a memcached backend does not perform key validation, passing\nmalformed cache keys could result in a key collision, and potential data\nleakage. In order to avoid this vulnerability, key validation is added to the\nmemcached cache backends.</p>\n</section>\n<section id=\"cve-2020-13596-possible-xss-via-admin-foreignkeyrawidwidget\">\n<h2>CVE-2020-13596: Possible XSS via admin <code class=\"docutils literal notranslate\">ForeignKeyRawIdWidget</code><a class=\"heading-anchor\" href=\"#cve-2020-13596-possible-xss-via-admin-foreignkeyrawidwidget\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Query parameters for the admin <code class=\"docutils literal notranslate\">ForeignKeyRawIdWidget</code> were not properly URL\nencoded, posing an XSS attack vector. <code class=\"docutils literal notranslate\">ForeignKeyRawIdWidget</code> now\nensures query parameters are correctly URL encoded.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a regression in Django 3.0 by restoring the ability to use field\nlookups in <code class=\"docutils literal notranslate\">Meta.ordering</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/31538\">#31538</a>).</p></li>\n<li><p>Fixed a regression in Django 3.0 where <code class=\"docutils literal notranslate\">QuerySet.values()</code> and\n<code class=\"docutils literal notranslate\">values_list()</code> crashed if a queryset contained an aggregation and a\nsubquery annotation (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/31566\">#31566</a>).</p></li>\n<li><p>Fixed a regression in Django 3.0 where aggregates used wrong annotations when\na queryset has multiple subqueries annotations (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/31568\">#31568</a>).</p></li>\n<li><p>Fixed a regression in Django 3.0 where <code class=\"docutils literal notranslate\">QuerySet.values()</code> and\n<code class=\"docutils literal notranslate\">values_list()</code> crashed if a queryset contained an aggregation and an\n<code class=\"docutils literal notranslate\">Exists()</code> annotation on Oracle (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/31584\">#31584</a>).</p></li>\n<li><p>Fixed a regression in Django 3.0 where all resolved <code class=\"docutils literal notranslate\">Subquery()</code>\nexpressions were considered equal (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/31607\">#31607</a>).</p></li>\n<li><p>Fixed a regression in Django 3.0.5 that affected translation loading for apps\nproviding translations for territorial language variants as well as a generic\nlanguage, where the project has different plural equations for the language\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/31570\">#31570</a>).</p></li>\n<li><p>Tracking a jQuery security release, upgraded the version of jQuery used by\nthe admin from 3.4.1 to 3.5.1.</p></li>\n</ul>\n</section>","rootId":"django-3-0-7-release-notes","toc":[{"title":"CVE-2020-13254: Potential data leakage via malformed memcached keys","anchor":"cve-2020-13254-potential-data-leakage-via-malformed-memcached-keys","children":[]},{"title":"CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget","anchor":"cve-2020-13596-possible-xss-via-admin-foreignkeyrawidwidget","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/3.0.8","title":"Django 3.0.8 release notes","url":"/en/dev/releases/3.0.8/"},"next":{"docname":"releases/3.0.6","title":"Django 3.0.6 release notes","url":"/en/dev/releases/3.0.6/"},"formats":{"html":"/en/dev/releases/3.0.7/","markdown":"/en/dev/releases/3.0.7.md","json":"/en/dev/releases/3.0.7.json"},"source":"https://github.com/django/django/blob/main/docs/releases/3.0.7.txt","official":"https://docs.djangoproject.com/en/dev/releases/3.0.7/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0"],"inLocales":["en"]}