---
title: "Notes de publication de Django 3.1.13"
version: 4.0
locale: fr
source: https://docs.djangoproject.com/fr/4.0/releases/3.1.13/
canonical: https://djangodocs.dev/fr/4.0/releases/3.1.13/
---
# Notes de publication de Django 3.1.13

*July 1, 2021*

Django 3.1.13 fixes a security issue with severity « high » in 3.1.12.

## CVE-2021-35042: Potential SQL injection via unsanitized `QuerySet.order_by()` input

Unsanitized user input passed to `QuerySet.order_by()` could bypass intended
column reference validation in path marked for deprecation resulting in a
potential SQL injection even if a deprecation warning is emitted.

As a mitigation the strict column reference validation was restored for the
duration of the deprecation period. This regression appeared in 3.1 as a side
effect of fixing [#31426](https://code.djangoproject.com/ticket/31426).

The issue is not present in the main branch as the deprecated path has been
removed.