{"title":"Django 3.2.4 release notes","version":"dev","locale":"en","docname":"releases/3.2.4","url":"/en/dev/releases/3.2.4/","canonical":"https://djangodocs.dev/en/dev/releases/3.2.4/","summary":"Django 3.2.4 fixes two security issues and several bugs in 3.2.3. Staff members could use the admindocs TemplateDetailView view to check the existence of…","html":"<h1>Django 3.2.4 release notes<a class=\"heading-anchor\" href=\"#django-3-2-4-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>June 2, 2021</em></p>\n<p>Django 3.2.4 fixes two security issues and several bugs in 3.2.3.</p>\n<section id=\"cve-2021-33203-potential-directory-traversal-via-admindocs\">\n<h2>CVE-2021-33203: Potential directory traversal via <code class=\"docutils literal notranslate\">admindocs</code><a class=\"heading-anchor\" href=\"#cve-2021-33203-potential-directory-traversal-via-admindocs\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Staff members could use the <a class=\"reference internal\" href=\"/en/dev/ref/contrib/admin/admindocs/#module-django.contrib.admindocs\" title=\"django.contrib.admindocs: Django's admin documentation generator.\"><code class=\"xref py py-mod docutils literal notranslate\">admindocs</code></a>\n<code class=\"docutils literal notranslate\">TemplateDetailView</code> view to check the existence of arbitrary files.\nAdditionally, if (and only if) the default admindocs templates have been\ncustomized by the developers to also expose the file contents, then not only\nthe existence but also the file contents would have been exposed.</p>\n<p>As a mitigation, path sanitation is now applied and only files within the\ntemplate root directories can be loaded.</p>\n</section>\n<section id=\"cve-2021-33571-possible-indeterminate-ssrf-rfi-and-lfi-attacks-since-validators-accepted-leading-zeros-in-ipv4-addresses\">\n<h2>CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses<a class=\"heading-anchor\" href=\"#cve-2021-33571-possible-indeterminate-ssrf-rfi-and-lfi-attacks-since-validators-accepted-leading-zeros-in-ipv4-addresses\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.URLValidator\" title=\"django.core.validators.URLValidator\"><code class=\"xref py py-class docutils literal notranslate\">URLValidator</code></a>,\n<a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.validate_ipv4_address\" title=\"django.core.validators.validate_ipv4_address\"><code class=\"xref py py-func docutils literal notranslate\">validate_ipv4_address()</code></a>, and\n<a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.validate_ipv46_address\" title=\"django.core.validators.validate_ipv46_address\"><code class=\"xref py py-func docutils literal notranslate\">validate_ipv46_address()</code></a> didn’t prohibit leading\nzeros in octal literals. If you used such values you could suffer from\nindeterminate SSRF, RFI, and LFI attacks.</p>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.validate_ipv4_address\" title=\"django.core.validators.validate_ipv4_address\"><code class=\"xref py py-func docutils literal notranslate\">validate_ipv4_address()</code></a> and\n<a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.validate_ipv46_address\" title=\"django.core.validators.validate_ipv46_address\"><code class=\"xref py py-func docutils literal notranslate\">validate_ipv46_address()</code></a> validators were not\naffected on Python 3.9.5+.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a bug in Django 3.2 where a final catch-all view in the admin didn’t\nrespect the server-provided value of <code class=\"docutils literal notranslate\">SCRIPT_NAME</code> when redirecting\nunauthenticated users to the login page (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/32754\">#32754</a>).</p></li>\n<li><p>Fixed a bug in Django 3.2 where a system check would crash on an abstract\nmodel (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/32733\">#32733</a>).</p></li>\n<li><p>Prevented unnecessary initialization of unused caches following a regression\nin Django 3.2 (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/32747\">#32747</a>).</p></li>\n<li><p>Fixed a crash in Django 3.2 that could occur when running <code class=\"docutils literal notranslate\">mod_wsgi</code> with\nthe recommended settings while the Windows <code class=\"docutils literal notranslate\">colorama</code> library was installed\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/32740\">#32740</a>).</p></li>\n<li><p>Fixed a bug in Django 3.2 that would trigger the auto-reloader for template\nchanges when directory paths were specified with strings (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/32744\">#32744</a>).</p></li>\n<li><p>Fixed a regression in Django 3.2 that caused a crash of auto-reloader with\n<code class=\"docutils literal notranslate\">AttributeError</code>, e.g. inside a <code class=\"docutils literal notranslate\">Conda</code> environment (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/32783\">#32783</a>).</p></li>\n<li><p>Fixed a regression in Django 3.2 that caused a loss of precision for\noperations with <code class=\"docutils literal notranslate\">DecimalField</code> on MySQL (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/32793\">#32793</a>).</p></li>\n</ul>\n</section>","rootId":"django-3-2-4-release-notes","toc":[{"title":"CVE-2021-33203: Potential directory traversal via admindocs","anchor":"cve-2021-33203-potential-directory-traversal-via-admindocs","children":[]},{"title":"CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses","anchor":"cve-2021-33571-possible-indeterminate-ssrf-rfi-and-lfi-attacks-since-validators-accepted-leading-zeros-in-ipv4-addresses","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/3.2.5","title":"Django 3.2.5 release notes","url":"/en/dev/releases/3.2.5/"},"next":{"docname":"releases/3.2.3","title":"Django 3.2.3 release notes","url":"/en/dev/releases/3.2.3/"},"formats":{"html":"/en/dev/releases/3.2.4/","markdown":"/en/dev/releases/3.2.4.md","json":"/en/dev/releases/3.2.4.json"},"source":"https://github.com/django/django/blob/main/docs/releases/3.2.4.txt","official":"https://docs.djangoproject.com/en/dev/releases/3.2.4/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2"],"inLocales":["en"]}