{"title":"Django 4.0.1 release notes","version":"dev","locale":"en","docname":"releases/4.0.1","url":"/en/dev/releases/4.0.1/","canonical":"https://djangodocs.dev/en/dev/releases/4.0.1/","summary":"Django 4.0.1 fixes one security issue with severity “medium”, two security issues with severity “low”, and several bugs in 4.0.","html":"

Django 4.0.1 release notesLink to this heading#

\n

January 4, 2022

\n

Django 4.0.1 fixes one security issue with severity “medium”, two security\nissues with severity “low”, and several bugs in 4.0.

\n
\n

CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidatorLink to this heading#

\n

UserAttributeSimilarityValidator incurred significant overhead\nevaluating submitted password that were artificially large in relative to the\ncomparison values. On the assumption that access to user registration was\nunrestricted this provided a potential vector for a denial-of-service attack.

\n

In order to mitigate this issue, relatively long values are now ignored by\nUserAttributeSimilarityValidator.

\n

This issue has severity “medium” according to the Django security policy.

\n
\n
\n

CVE-2021-45116: Potential information disclosure in dictsort template filterLink to this heading#

\n

Due to leveraging the Django Template Language’s variable resolution logic, the\ndictsort template filter was potentially vulnerable to information\ndisclosure or unintended method calls, if passed a suitably crafted key.

\n

In order to avoid this possibility, dictsort now works with a restricted\nresolution logic, that will not call methods, nor allow indexing on\ndictionaries.

\n

As a reminder, all untrusted user input should be validated before use.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

CVE-2021-45452: Potential directory-traversal via Storage.save()Link to this heading#

\n

Storage.save() allowed directory-traversal if directly passed suitably\ncrafted file names.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-4-0-1-release-notes","toc":[{"title":"CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator","anchor":"cve-2021-45115-denial-of-service-possibility-in-userattributesimilarityvalidator","children":[]},{"title":"CVE-2021-45116: Potential information disclosure in dictsort template filter","anchor":"cve-2021-45116-potential-information-disclosure-in-dictsort-template-filter","children":[]},{"title":"CVE-2021-45452: Potential directory-traversal via Storage.save()","anchor":"cve-2021-45452-potential-directory-traversal-via-storage-save","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/4.0.2","title":"Django 4.0.2 release notes","url":"/en/dev/releases/4.0.2/"},"next":{"docname":"releases/4.0","title":"Django 4.0 release notes","url":"/en/dev/releases/4.0/"},"formats":{"html":"/en/dev/releases/4.0.1/","markdown":"/en/dev/releases/4.0.1.md","json":"/en/dev/releases/4.0.1.json"},"source":"https://github.com/django/django/blob/main/docs/releases/4.0.1.txt","official":"https://docs.djangoproject.com/en/dev/releases/4.0.1/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0"],"inLocales":["en"]}