{"title":"セキュリティ上の問題のアーカイブ","version":"3.2","locale":"ja","docname":"releases/security","url":"/ja/3.2/releases/security/","canonical":"https://djangodocs.dev/ja/3.2/releases/security/","summary":"Django の開発チームは、 Django のセキュリティポリシー にしたがって、セキュリティに関わる問題を、責任を持って積極的に公表しています。 この活動の一部として、修正・公開した問題の履歴リストをメンテナンスしています。以下のリストには、各問題に対して、日付、短い説明、もし存在すれば CVE identifier…","html":"

セキュリティ上の問題のアーカイブLink to this heading#

\n

Django の開発チームは、Django のセキュリティポリシー にしたがって、セキュリティに関わる問題を、責任を持って積極的に公表しています。

\n

この活動の一部として、修正・公開した問題の履歴リストをメンテナンスしています。以下のリストには、各問題に対して、日付、短い説明、もし存在すれば CVE identifier 、影響を受けるバージョン、完全な情報開示ページへのリンク、適切なパッチへのリンクが記載されています。

\n

これらの情報に関する重要な注意書き

\n\n
\n

Issues under Django's security processLink to this heading#

\n

All security issues have been handled under versions of Django's security\nprocess. These are listed below.

\n
\n

March 4, 2024 - CVE 2024-27351Link to this heading#

\n

Potential regular expression denial-of-service in\ndjango.utils.text.Truncator.words(). Full description

\n\n
\n
\n

February 6, 2024 - CVE 2024-24680Link to this heading#

\n

Potential denial-of-service in intcomma template filter.\nFull description

\n\n
\n
\n

November 1, 2023 - CVE 2023-46695Link to this heading#

\n

Potential denial of service vulnerability in UsernameField on Windows.\nFull description

\n\n
\n
\n

October 4, 2023 - CVE 2023-43665Link to this heading#

\n

Denial-of-service possibility in django.utils.text.Truncator.\nFull description

\n\n
\n
\n

September 4, 2023 - CVE 2023-41164Link to this heading#

\n

Potential denial of service vulnerability in\ndjango.utils.encoding.uri_to_iri(). Full description

\n\n
\n
\n

July 3, 2023 - CVE 2023-36053Link to this heading#

\n

Potential regular expression denial of service vulnerability in\nEmailValidator/URLValidator. Full description

\n\n
\n
\n

May 3, 2023 - CVE 2023-31047Link to this heading#

\n

Potential bypass of validation when uploading multiple files using one form\nfield. Full description

\n\n
\n
\n

February 14, 2023 - CVE 2023-24580Link to this heading#

\n

Potential denial-of-service vulnerability in file uploads. Full description

\n\n
\n
\n

February 1, 2023 - CVE 2023-23969Link to this heading#

\n

Potential denial-of-service via Accept-Language headers. Full description

\n\n
\n
\n

October 4, 2022 - CVE 2022-41323Link to this heading#

\n

Potential denial-of-service vulnerability in internationalized URLs. Full\ndescription

\n\n
\n
\n

August 3, 2022 - CVE 2022-36359Link to this heading#

\n

Potential reflected file download vulnerability in FileResponse. Full\ndescription

\n\n
\n
\n

July 4, 2022 - CVE 2022-34265Link to this heading#

\n

Potential SQL injection via Trunc(kind) and Extract(lookup_name)\narguments. Full description

\n\n
\n
\n

April 11, 2022 - CVE 2022-28346Link to this heading#

\n

Potential SQL injection in QuerySet.annotate(), aggregate(), and\nextra(). Full description

\n\n
\n
\n

April 11, 2022 - CVE 2022-28347Link to this heading#

\n

Potential SQL injection via QuerySet.explain(**options) on PostgreSQL.\nFull description

\n\n
\n
\n

February 1, 2022 - CVE 2022-22818Link to this heading#

\n

Possible XSS via {% debug %} template tag. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 1, 2022 - CVE 2022-23833Link to this heading#

\n

Denial-of-service possibility in file uploads. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45452Link to this heading#

\n

Potential directory-traversal via Storage.save(). Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45116Link to this heading#

\n

Potential information disclosure in dictsort template filter. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45115Link to this heading#

\n

Denial-of-service possibility in UserAttributeSimilarityValidator. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

December 7, 2021 - CVE 2021-44420Link to this heading#

\n

Potential bypass of an upstream access control based on URL paths. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 1, 2021 - CVE 2021-35042Link to this heading#

\n

Potential SQL injection via unsanitized QuerySet.order_by() input. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

June 2, 2021 - CVE 2021-33203Link to this heading#

\n

Potential directory traversal via admindocs. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

June 2, 2021 - CVE 2021-33571Link to this heading#

\n

Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted\nleading zeros in IPv4 addresses. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

May 6, 2021 - CVE 2021-32052Link to this heading#

\n

Header injection possibility since URLValidator accepted newlines in input\non Python 3.9.5+. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

May 4, 2021 - CVE 2021-31542Link to this heading#

\n

Potential directory-traversal via uploaded files. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

April 6, 2021 - CVE 2021-28658Link to this heading#

\n

Potential directory-traversal via uploaded files. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 19, 2021 - CVE 2021-23336Link to this heading#

\n

Web cache poisoning via django.utils.http.limited_parse_qsl(). Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 1, 2021 - CVE 2021-3281Link to this heading#

\n

Potential directory-traversal via archive.extract(). Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 1, 2020 - CVE 2020-24584Link to this heading#

\n

Permission escalation in intermediate-level directories of the file system\ncache on Python 3.7+. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 1, 2020 - CVE 2020-24583Link to this heading#

\n

Incorrect permissions on intermediate-level directories on Python 3.7+. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

June 3, 2020 - CVE 2020-13596Link to this heading#

\n

Possible XSS via admin ForeignKeyRawIdWidget. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

June 3, 2020 - CVE 2020-13254Link to this heading#

\n

Potential data leakage via malformed memcached keys. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

March 4, 2020 - CVE 2020-9402Link to this heading#

\n

Potential SQL injection via tolerance parameter in GIS functions and\naggregates on Oracle. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 3, 2020 - CVE 2020-7471Link to this heading#

\n

StringAgg(delimiter) を通じた潜在的 SQL インジェクション. ` <https://www.djangoproject.com/weblog/2020/feb/03/security-releases/>`__

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

December 18, 2019 - CVE 2019-19844Link to this heading#

\n

Potential account hijack via password reset form. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

December 2, 2019 - CVE 2019-19118Link to this heading#

\n

Privilege escalation in the Django admin. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2019年8月1日 - CVE 2019-14235Link to this heading#

\n

django.utils.encoding.uri_to_iri() におけるメモリ枯渇の可能性。詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14234Link to this heading#

\n

SQL injection possibility in key and index lookups for\nJSONField/HStoreField. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14233Link to this heading#

\n

Denial-of-service possibility in strip_tags(). Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14232Link to this heading#

\n

Denial-of-service possibility in django.utils.text.Truncator. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 1, 2019 - CVE 2019-12781Link to this heading#

\n

Incorrect HTTP detection with reverse-proxy connecting via HTTPS. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

June 3, 2019 - CVE 2019-12308Link to this heading#

\n

XSS via "Current URL" link generated by AdminURLFieldWidget. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

June 3, 2019 - CVE 2019-11358Link to this heading#

\n

Prototype pollution in bundled jQuery. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2019年2月11日 - CVE 2019-6975Link to this heading#

\n

django.utils.numberformat.format() におけるメモリ枯渇の問題。詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2019年1月4日 - CVE 2019-3498Link to this heading#

\n

デフォルトの 404 ページにおけるコンテンツスプーフィングの可能性。詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2018年10月1日 - CVE 2018-16984Link to this heading#

\n

Password hash disclosure to 「表示のみ (view only)」の admin ユーザーにパスワードのハッシュが意図せず公開されてしまう問題。詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2018年8月1日 - CVE 2018-14574Link to this heading#

\n

CommonMiddleware におけるオープンリダイレクトの可能性。詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2018年3月6日 - CVE 2018-7537Link to this heading#

\n

truncatechars_html と truncatewords_html テンプレートフィルタにおけるDoS 攻撃の可能性。 詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2018年3月6日 - CVE 2018-7536Link to this heading#

\n

urlize と urlizetrunc テンプレートフィルタにおける DoS 攻撃の可能性。詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2018年2月1日 - CVE 2018-6188Link to this heading#

\n

AuthenticationForm における情報漏えい問題。詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2017年9月5日 - CVE 2017-12794Link to this heading#

\n

Possible XSS in traceback section of technical 500 debug page. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

April 4, 2017 - CVE 2017-7234Link to this heading#

\n

Open redirect vulnerability in django.views.static.serve(). Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

April 4, 2017 - CVE 2017-7233Link to this heading#

\n

Open redirect and possible XSS attack via user-supplied numeric redirect URLs.\nFull description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

November 1, 2016 - CVE 2016-9014Link to this heading#

\n

DNS rebinding vulnerability when DEBUG=True. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

November 1, 2016 - CVE 2016-9013Link to this heading#

\n

User with hardcoded password created when running tests on Oracle. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 26, 2016 - CVE 2016-7401Link to this heading#

\n

CSRF protection bypass on a site with Google Analytics. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 18, 2016 - CVE 2016-6186Link to this heading#

\n

XSS in admin's add/change related popup. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

March 1, 2016 - CVE 2016-2513Link to this heading#

\n

User enumeration through timing difference on password hasher work factor\nupgrade. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

March 1, 2016 - CVE 2016-2512Link to this heading#

\n

Malicious redirect and possible XSS attack via user-supplied redirect URLs\ncontaining basic auth. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 1, 2016 - CVE 2016-2048Link to this heading#

\n

User with "change" but not "add" permission can create objects for\nModelAdmin’s with save_as=True. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

November 24, 2015 - CVE 2015-8213Link to this heading#

\n

Settings leak possibility in date template filter. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 18, 2015 - CVE 2015-5963 / CVE 2015-5964Link to this heading#

\n

Denial-of-service possibility in logout() view by filling session store.\nFull description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5145Link to this heading#

\n

Denial-of-service possibility in URL validation. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5144Link to this heading#

\n

Header injection possibility since validators accept newlines in input. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5143Link to this heading#

\n

Denial-of-service possibility by filling session store. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

May 20, 2015 - CVE 2015-3982Link to this heading#

\n

Fixed session flushing in the cached_db backend. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

March 18, 2015 - CVE 2015-2317Link to this heading#

\n

Mitigated possible XSS attack via user-supplied redirect URLs. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

March 18, 2015 - CVE 2015-2316Link to this heading#

\n

Denial-of-service possibility with strip_tags(). Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

March 9, 2015 - CVE 2015-2241Link to this heading#

\n

XSS attack via properties in ModelAdmin.readonly_fields. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0222Link to this heading#

\n

Database denial-of-service with ModelMultipleChoiceField. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0221Link to this heading#

\n

Denial-of-service attack against django.views.static.serve(). Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0220Link to this heading#

\n

Mitigated possible XSS attack via user-supplied redirect URLs. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0219Link to this heading#

\n

WSGI header spoofing via underscore/dash conflation. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0483Link to this heading#

\n

Data leakage via querystring manipulation in admin.\nFull description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0482Link to this heading#

\n

RemoteUserMiddleware session hijacking. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0481Link to this heading#

\n

File upload denial of service. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0480Link to this heading#

\n

reverse() can generate URLs pointing to other hosts. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

May 18, 2014 - CVE 2014-3730Link to this heading#

\n

Malformed URLs from user input incorrectly validated. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

May 18, 2014 - CVE 2014-1418Link to this heading#

\n

Caches may be allowed to store and serve private data. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0474Link to this heading#

\n

MySQL typecasting causes unexpected query results. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0473Link to this heading#

\n

Caching of anonymous pages could reveal CSRF token. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0472Link to this heading#

\n

Unexpected code execution using reverse(). Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 14, 2013 - CVE 2013-1443Link to this heading#

\n

Denial-of-service via large passwords. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 10, 2013 - CVE 2013-4315Link to this heading#

\n

Directory-traversal via ssi template tag. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 13, 2013 - CVE 2013-6044Link to this heading#

\n

Possible XSS via unvalidated URL redirect schemes. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

August 13, 2013 - CVE 2013-4249Link to this heading#

\n

XSS via admin trusting URLField values. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-0306Link to this heading#

\n

Denial-of-service via formset max_num bypass. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-0305Link to this heading#

\n

Information leakage via admin history log. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-1664 / CVE 2013-1665Link to this heading#

\n

Entity-based attacks against Python XML libraries. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - No CVELink to this heading#

\n

Additional hardening of Host header handling. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

December 10, 2012 - No CVE 2Link to this heading#

\n

Additional hardening of redirect validation. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

December 10, 2012 - No CVE 1Link to this heading#

\n

Additional hardening of Host header handling. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

October 17, 2012 - CVE 2012-4520Link to this heading#

\n

Host header poisoning. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3444Link to this heading#

\n

Denial-of-service via large image files. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3443Link to this heading#

\n

Denial-of-service via compressed image files. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3442Link to this heading#

\n

XSS via failure to validate redirect scheme. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4140Link to this heading#

\n

Potential CSRF via Host header. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n

This notification was an advisory only, so no patches were issued.

\n
    \n

  • Django 1.2

    • \n

  • Django 1.3

    • \n
\n
\n
\n
\n

September 9, 2011 - CVE 2011-4139Link to this heading#

\n

Host header cache poisoning. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4138Link to this heading#

\n

Information leakage/arbitrary request issuance via URLField.verify_exists.\nFull description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4137Link to this heading#

\n

Denial-of-service via URLField.verify_exists. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4136Link to this heading#

\n

Session manipulation when using memory-cache-backed session. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0698Link to this heading#

\n

Directory-traversal on Windows via incorrect path-separator handling. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0697Link to this heading#

\n

XSS via unsanitized names of uploaded files. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0696Link to this heading#

\n

CSRF via forged HTTP headers. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

December 22, 2010 - CVE 2010-4535Link to this heading#

\n

Denial-of-service in password-reset mechanism. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

December 22, 2010 - CVE 2010-4534Link to this heading#

\n

Information leakage in administrative interface. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 8, 2010 - CVE 2010-3082Link to this heading#

\n

XSS via trusting unsafe cookie value. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

October 9, 2009 - CVE 2009-3965Link to this heading#

\n

Denial-of-service via pathological regular expression performance. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

July 28, 2009 - CVE 2009-2659Link to this heading#

\n

Directory-traversal in development server media handler. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

September 2, 2008 - CVE 2008-3909Link to this heading#

\n

CSRF via preservation of POST data during admin login. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

May 14, 2008 - CVE 2008-2302Link to this heading#

\n

XSS via admin login redirect. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

October 26, 2007 - CVE 2007-5712Link to this heading#

\n

Denial-of-service via arbitrarily-large Accept-Language header. Full\ndescription

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n
\n

Django のセキュリティプロセスで解決される前の問題Link to this heading#

\n

いくつかのセキュリティ問題については、Django が正式にセキュリティ問題の処理プロセスを確立する以前に修正されました。そのような修正に対しては、新しいリリースが出されたときに修正された CVE が記載されていないことがあります。

\n
\n

January 21, 2007 - CVE 2007-0405Link to this heading#

\n

Apparent "caching" of authenticated user. Full description

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
\n

2006年8月16日 - CVE 2007-0404Link to this heading#

\n

翻訳フレームワークにおけるファイル名の検証問題。 詳細な説明

\n
\n

影響を受けるバージョンLink to this heading#

\n\n
\n
\n
","rootId":"archive-of-security-issues","toc":[{"title":"Issues under Django's security process","anchor":"issues-under-django-s-security-process","children":[{"title":"March 4, 2024 - CVE 2024-27351","anchor":"march-4-2024-cve-2024-27351","children":[]},{"title":"February 6, 2024 - CVE 2024-24680","anchor":"february-6-2024-cve-2024-24680","children":[]},{"title":"November 1, 2023 - CVE 2023-46695","anchor":"november-1-2023-cve-2023-46695","children":[]},{"title":"October 4, 2023 - CVE 2023-43665","anchor":"october-4-2023-cve-2023-43665","children":[]},{"title":"September 4, 2023 - CVE 2023-41164","anchor":"september-4-2023-cve-2023-41164","children":[]},{"title":"July 3, 2023 - CVE 2023-36053","anchor":"july-3-2023-cve-2023-36053","children":[]},{"title":"May 3, 2023 - CVE 2023-31047","anchor":"may-3-2023-cve-2023-31047","children":[]},{"title":"February 14, 2023 - CVE 2023-24580","anchor":"february-14-2023-cve-2023-24580","children":[]},{"title":"February 1, 2023 - CVE 2023-23969","anchor":"february-1-2023-cve-2023-23969","children":[]},{"title":"October 4, 2022 - CVE 2022-41323","anchor":"october-4-2022-cve-2022-41323","children":[]},{"title":"August 3, 2022 - CVE 2022-36359","anchor":"august-3-2022-cve-2022-36359","children":[]},{"title":"July 4, 2022 - CVE 2022-34265","anchor":"july-4-2022-cve-2022-34265","children":[]},{"title":"April 11, 2022 - CVE 2022-28346","anchor":"april-11-2022-cve-2022-28346","children":[]},{"title":"April 11, 2022 - CVE 2022-28347","anchor":"april-11-2022-cve-2022-28347","children":[]},{"title":"February 1, 2022 - CVE 2022-22818","anchor":"february-1-2022-cve-2022-22818","children":[{"title":"影響を受けるバージョン","anchor":"versions-affected","children":[]}]},{"title":"February 1, 2022 - CVE 2022-23833","anchor":"february-1-2022-cve-2022-23833","children":[{"title":"影響を受けるバージョン","anchor":"id1","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45452","anchor":"january-4-2022-cve-2021-45452","children":[{"title":"影響を受けるバージョン","anchor":"id2","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45116","anchor":"january-4-2022-cve-2021-45116","children":[{"title":"影響を受けるバージョン","anchor":"id3","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45115","anchor":"january-4-2022-cve-2021-45115","children":[{"title":"影響を受けるバージョン","anchor":"id4","children":[]}]},{"title":"December 7, 2021 - CVE 2021-44420","anchor":"december-7-2021-cve-2021-44420","children":[{"title":"影響を受けるバージョン","anchor":"id5","children":[]}]},{"title":"July 1, 2021 - CVE 2021-35042","anchor":"july-1-2021-cve-2021-35042","children":[{"title":"影響を受けるバージョン","anchor":"id6","children":[]}]},{"title":"June 2, 2021 - CVE 2021-33203","anchor":"june-2-2021-cve-2021-33203","children":[{"title":"影響を受けるバージョン","anchor":"id7","children":[]}]},{"title":"June 2, 2021 - CVE 2021-33571","anchor":"june-2-2021-cve-2021-33571","children":[{"title":"影響を受けるバージョン","anchor":"id8","children":[]}]},{"title":"May 6, 2021 - CVE 2021-32052","anchor":"may-6-2021-cve-2021-32052","children":[{"title":"影響を受けるバージョン","anchor":"id9","children":[]}]},{"title":"May 4, 2021 - CVE 2021-31542","anchor":"may-4-2021-cve-2021-31542","children":[{"title":"影響を受けるバージョン","anchor":"id10","children":[]}]},{"title":"April 6, 2021 - CVE 2021-28658","anchor":"april-6-2021-cve-2021-28658","children":[{"title":"影響を受けるバージョン","anchor":"id11","children":[]}]},{"title":"February 19, 2021 - CVE 2021-23336","anchor":"february-19-2021-cve-2021-23336","children":[{"title":"影響を受けるバージョン","anchor":"id12","children":[]}]},{"title":"February 1, 2021 - CVE 2021-3281","anchor":"february-1-2021-cve-2021-3281","children":[{"title":"影響を受けるバージョン","anchor":"id13","children":[]}]},{"title":"September 1, 2020 - CVE 2020-24584","anchor":"september-1-2020-cve-2020-24584","children":[{"title":"影響を受けるバージョン","anchor":"id14","children":[]}]},{"title":"September 1, 2020 - CVE 2020-24583","anchor":"september-1-2020-cve-2020-24583","children":[{"title":"影響を受けるバージョン","anchor":"id15","children":[]}]},{"title":"June 3, 2020 - CVE 2020-13596","anchor":"june-3-2020-cve-2020-13596","children":[{"title":"影響を受けるバージョン","anchor":"id16","children":[]}]},{"title":"June 3, 2020 - CVE 2020-13254","anchor":"june-3-2020-cve-2020-13254","children":[{"title":"影響を受けるバージョン","anchor":"id17","children":[]}]},{"title":"March 4, 2020 - CVE 2020-9402","anchor":"march-4-2020-cve-2020-9402","children":[{"title":"影響を受けるバージョン","anchor":"id18","children":[]}]},{"title":"February 3, 2020 - CVE 2020-7471","anchor":"february-3-2020-cve-2020-7471","children":[{"title":"影響を受けるバージョン","anchor":"id19","children":[]}]},{"title":"December 18, 2019 - CVE 2019-19844","anchor":"december-18-2019-cve-2019-19844","children":[{"title":"影響を受けるバージョン","anchor":"id20","children":[]}]},{"title":"December 2, 2019 - CVE 2019-19118","anchor":"december-2-2019-cve-2019-19118","children":[{"title":"影響を受けるバージョン","anchor":"id21","children":[]}]},{"title":"2019年8月1日 - CVE 2019-14235","anchor":"august-1-2019-cve-2019-14235","children":[{"title":"影響を受けるバージョン","anchor":"id22","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14234","anchor":"august-1-2019-cve-2019-14234","children":[{"title":"影響を受けるバージョン","anchor":"id23","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14233","anchor":"august-1-2019-cve-2019-14233","children":[{"title":"影響を受けるバージョン","anchor":"id24","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14232","anchor":"august-1-2019-cve-2019-14232","children":[{"title":"影響を受けるバージョン","anchor":"id25","children":[]}]},{"title":"July 1, 2019 - CVE 2019-12781","anchor":"july-1-2019-cve-2019-12781","children":[{"title":"影響を受けるバージョン","anchor":"id26","children":[]}]},{"title":"June 3, 2019 - CVE 2019-12308","anchor":"june-3-2019-cve-2019-12308","children":[{"title":"影響を受けるバージョン","anchor":"id27","children":[]}]},{"title":"June 3, 2019 - CVE 2019-11358","anchor":"june-3-2019-cve-2019-11358","children":[{"title":"影響を受けるバージョン","anchor":"id28","children":[]}]},{"title":"2019年2月11日 - CVE 2019-6975","anchor":"february-11-2019-cve-2019-6975","children":[{"title":"影響を受けるバージョン","anchor":"id29","children":[]}]},{"title":"2019年1月4日 - CVE 2019-3498","anchor":"january-4-2019-cve-2019-3498","children":[{"title":"影響を受けるバージョン","anchor":"id30","children":[]}]},{"title":"2018年10月1日 - CVE 2018-16984","anchor":"october-1-2018-cve-2018-16984","children":[{"title":"影響を受けるバージョン","anchor":"id31","children":[]}]},{"title":"2018年8月1日 - CVE 2018-14574","anchor":"august-1-2018-cve-2018-14574","children":[{"title":"影響を受けるバージョン","anchor":"id32","children":[]}]},{"title":"2018年3月6日 - CVE 2018-7537","anchor":"march-6-2018-cve-2018-7537","children":[{"title":"影響を受けるバージョン","anchor":"id33","children":[]}]},{"title":"2018年3月6日 - CVE 2018-7536","anchor":"march-6-2018-cve-2018-7536","children":[{"title":"影響を受けるバージョン","anchor":"id34","children":[]}]},{"title":"2018年2月1日 - CVE 2018-6188","anchor":"february-1-2018-cve-2018-6188","children":[{"title":"影響を受けるバージョン","anchor":"id35","children":[]}]},{"title":"2017年9月5日 - CVE 2017-12794","anchor":"september-5-2017-cve-2017-12794","children":[{"title":"影響を受けるバージョン","anchor":"id36","children":[]}]},{"title":"April 4, 2017 - CVE 2017-7234","anchor":"april-4-2017-cve-2017-7234","children":[{"title":"影響を受けるバージョン","anchor":"id37","children":[]}]},{"title":"April 4, 2017 - CVE 2017-7233","anchor":"april-4-2017-cve-2017-7233","children":[{"title":"影響を受けるバージョン","anchor":"id38","children":[]}]},{"title":"November 1, 2016 - CVE 2016-9014","anchor":"november-1-2016-cve-2016-9014","children":[{"title":"影響を受けるバージョン","anchor":"id39","children":[]}]},{"title":"November 1, 2016 - CVE 2016-9013","anchor":"november-1-2016-cve-2016-9013","children":[{"title":"影響を受けるバージョン","anchor":"id40","children":[]}]},{"title":"September 26, 2016 - CVE 2016-7401","anchor":"september-26-2016-cve-2016-7401","children":[{"title":"影響を受けるバージョン","anchor":"id41","children":[]}]},{"title":"July 18, 2016 - CVE 2016-6186","anchor":"july-18-2016-cve-2016-6186","children":[{"title":"影響を受けるバージョン","anchor":"id42","children":[]}]},{"title":"March 1, 2016 - CVE 2016-2513","anchor":"march-1-2016-cve-2016-2513","children":[{"title":"影響を受けるバージョン","anchor":"id43","children":[]}]},{"title":"March 1, 2016 - CVE 2016-2512","anchor":"march-1-2016-cve-2016-2512","children":[{"title":"影響を受けるバージョン","anchor":"id44","children":[]}]},{"title":"February 1, 2016 - CVE 2016-2048","anchor":"february-1-2016-cve-2016-2048","children":[{"title":"影響を受けるバージョン","anchor":"id45","children":[]}]},{"title":"November 24, 2015 - CVE 2015-8213","anchor":"november-24-2015-cve-2015-8213","children":[{"title":"影響を受けるバージョン","anchor":"id46","children":[]}]},{"title":"August 18, 2015 - CVE 2015-5963 / CVE 2015-5964","anchor":"august-18-2015-cve-2015-5963-cve-2015-5964","children":[{"title":"影響を受けるバージョン","anchor":"id47","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5145","anchor":"july-8-2015-cve-2015-5145","children":[{"title":"影響を受けるバージョン","anchor":"id48","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5144","anchor":"july-8-2015-cve-2015-5144","children":[{"title":"影響を受けるバージョン","anchor":"id49","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5143","anchor":"july-8-2015-cve-2015-5143","children":[{"title":"影響を受けるバージョン","anchor":"id50","children":[]}]},{"title":"May 20, 2015 - CVE 2015-3982","anchor":"may-20-2015-cve-2015-3982","children":[{"title":"影響を受けるバージョン","anchor":"id51","children":[]}]},{"title":"March 18, 2015 - CVE 2015-2317","anchor":"march-18-2015-cve-2015-2317","children":[{"title":"影響を受けるバージョン","anchor":"id52","children":[]}]},{"title":"March 18, 2015 - CVE 2015-2316","anchor":"march-18-2015-cve-2015-2316","children":[{"title":"影響を受けるバージョン","anchor":"id53","children":[]}]},{"title":"March 9, 2015 - CVE 2015-2241","anchor":"march-9-2015-cve-2015-2241","children":[{"title":"影響を受けるバージョン","anchor":"id54","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0222","anchor":"january-13-2015-cve-2015-0222","children":[{"title":"影響を受けるバージョン","anchor":"id55","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0221","anchor":"january-13-2015-cve-2015-0221","children":[{"title":"影響を受けるバージョン","anchor":"id56","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0220","anchor":"january-13-2015-cve-2015-0220","children":[{"title":"影響を受けるバージョン","anchor":"id57","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0219","anchor":"january-13-2015-cve-2015-0219","children":[{"title":"影響を受けるバージョン","anchor":"id58","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0483","anchor":"august-20-2014-cve-2014-0483","children":[{"title":"影響を受けるバージョン","anchor":"id59","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0482","anchor":"august-20-2014-cve-2014-0482","children":[{"title":"影響を受けるバージョン","anchor":"id60","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0481","anchor":"august-20-2014-cve-2014-0481","children":[{"title":"影響を受けるバージョン","anchor":"id61","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0480","anchor":"august-20-2014-cve-2014-0480","children":[{"title":"影響を受けるバージョン","anchor":"id62","children":[]}]},{"title":"May 18, 2014 - CVE 2014-3730","anchor":"may-18-2014-cve-2014-3730","children":[{"title":"影響を受けるバージョン","anchor":"id63","children":[]}]},{"title":"May 18, 2014 - CVE 2014-1418","anchor":"may-18-2014-cve-2014-1418","children":[{"title":"影響を受けるバージョン","anchor":"id64","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0474","anchor":"april-21-2014-cve-2014-0474","children":[{"title":"影響を受けるバージョン","anchor":"id65","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0473","anchor":"april-21-2014-cve-2014-0473","children":[{"title":"影響を受けるバージョン","anchor":"id66","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0472","anchor":"april-21-2014-cve-2014-0472","children":[{"title":"影響を受けるバージョン","anchor":"id67","children":[]}]},{"title":"September 14, 2013 - CVE 2013-1443","anchor":"september-14-2013-cve-2013-1443","children":[{"title":"影響を受けるバージョン","anchor":"id68","children":[]}]},{"title":"September 10, 2013 - CVE 2013-4315","anchor":"september-10-2013-cve-2013-4315","children":[{"title":"影響を受けるバージョン","anchor":"id69","children":[]}]},{"title":"August 13, 2013 - CVE 2013-6044","anchor":"august-13-2013-cve-2013-6044","children":[{"title":"影響を受けるバージョン","anchor":"id70","children":[]}]},{"title":"August 13, 2013 - CVE 2013-4249","anchor":"august-13-2013-cve-2013-4249","children":[{"title":"影響を受けるバージョン","anchor":"id71","children":[]}]},{"title":"February 19, 2013 - CVE 2013-0306","anchor":"february-19-2013-cve-2013-0306","children":[{"title":"影響を受けるバージョン","anchor":"id72","children":[]}]},{"title":"February 19, 2013 - CVE 2013-0305","anchor":"february-19-2013-cve-2013-0305","children":[{"title":"影響を受けるバージョン","anchor":"id73","children":[]}]},{"title":"February 19, 2013 - CVE 2013-1664 / CVE 2013-1665","anchor":"february-19-2013-cve-2013-1664-cve-2013-1665","children":[{"title":"影響を受けるバージョン","anchor":"id74","children":[]}]},{"title":"February 19, 2013 - No CVE","anchor":"february-19-2013-no-cve","children":[{"title":"影響を受けるバージョン","anchor":"id75","children":[]}]},{"title":"December 10, 2012 - No CVE 2","anchor":"december-10-2012-no-cve-2","children":[{"title":"影響を受けるバージョン","anchor":"id76","children":[]}]},{"title":"December 10, 2012 - No CVE 1","anchor":"december-10-2012-no-cve-1","children":[{"title":"影響を受けるバージョン","anchor":"id77","children":[]}]},{"title":"October 17, 2012 - CVE 2012-4520","anchor":"october-17-2012-cve-2012-4520","children":[{"title":"影響を受けるバージョン","anchor":"id78","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3444","anchor":"july-30-2012-cve-2012-3444","children":[{"title":"影響を受けるバージョン","anchor":"id79","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3443","anchor":"july-30-2012-cve-2012-3443","children":[{"title":"影響を受けるバージョン","anchor":"id80","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3442","anchor":"july-30-2012-cve-2012-3442","children":[{"title":"影響を受けるバージョン","anchor":"id81","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4140","anchor":"september-9-2011-cve-2011-4140","children":[{"title":"影響を受けるバージョン","anchor":"id82","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4139","anchor":"september-9-2011-cve-2011-4139","children":[{"title":"影響を受けるバージョン","anchor":"id83","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4138","anchor":"september-9-2011-cve-2011-4138","children":[{"title":"影響を受けるバージョン","anchor":"id84","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4137","anchor":"september-9-2011-cve-2011-4137","children":[{"title":"影響を受けるバージョン","anchor":"id85","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4136","anchor":"september-9-2011-cve-2011-4136","children":[{"title":"影響を受けるバージョン","anchor":"id86","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0698","anchor":"february-8-2011-cve-2011-0698","children":[{"title":"影響を受けるバージョン","anchor":"id87","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0697","anchor":"february-8-2011-cve-2011-0697","children":[{"title":"影響を受けるバージョン","anchor":"id88","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0696","anchor":"february-8-2011-cve-2011-0696","children":[{"title":"影響を受けるバージョン","anchor":"id89","children":[]}]},{"title":"December 22, 2010 - CVE 2010-4535","anchor":"december-22-2010-cve-2010-4535","children":[{"title":"影響を受けるバージョン","anchor":"id90","children":[]}]},{"title":"December 22, 2010 - CVE 2010-4534","anchor":"december-22-2010-cve-2010-4534","children":[{"title":"影響を受けるバージョン","anchor":"id91","children":[]}]},{"title":"September 8, 2010 - CVE 2010-3082","anchor":"september-8-2010-cve-2010-3082","children":[{"title":"影響を受けるバージョン","anchor":"id92","children":[]}]},{"title":"October 9, 2009 - CVE 2009-3965","anchor":"october-9-2009-cve-2009-3965","children":[{"title":"影響を受けるバージョン","anchor":"id93","children":[]}]},{"title":"July 28, 2009 - CVE 2009-2659","anchor":"july-28-2009-cve-2009-2659","children":[{"title":"影響を受けるバージョン","anchor":"id94","children":[]}]},{"title":"September 2, 2008 - CVE 2008-3909","anchor":"september-2-2008-cve-2008-3909","children":[{"title":"影響を受けるバージョン","anchor":"id95","children":[]}]},{"title":"May 14, 2008 - CVE 2008-2302","anchor":"may-14-2008-cve-2008-2302","children":[{"title":"影響を受けるバージョン","anchor":"id96","children":[]}]},{"title":"October 26, 2007 - CVE 2007-5712","anchor":"october-26-2007-cve-2007-5712","children":[{"title":"影響を受けるバージョン","anchor":"id97","children":[]}]}]},{"title":"Django のセキュリティプロセスで解決される前の問題","anchor":"issues-prior-to-django-s-security-process","children":[{"title":"January 21, 2007 - CVE 2007-0405","anchor":"january-21-2007-cve-2007-0405","children":[{"title":"影響を受けるバージョン","anchor":"id98","children":[]}]},{"title":"2006年8月16日 - CVE 2007-0404","anchor":"august-16-2006-cve-2007-0404","children":[{"title":"影響を受けるバージョン","anchor":"id99","children":[]}]}]}],"breadcrumbs":[{"docname":"releases/index","title":"リリースノート","url":"/ja/3.2/releases/"}],"prev":{"docname":"releases/0.95","title":"Django 0.95 リリースノート","url":"/ja/3.2/releases/0.95/"},"next":{"docname":"internals/index","title":"Django internals","url":"/ja/3.2/internals/"},"formats":{"html":"/ja/3.2/releases/security/","markdown":"/ja/3.2/releases/security.md","json":"/ja/3.2/releases/security.json"},"source":"https://github.com/django/django/blob/stable/3.2.x/docs/releases/security.txt","official":"https://docs.djangoproject.com/ja/3.2/releases/security/","inVersions":["6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9"],"inLocales":["en","zh-hans","fr","ja","id","it","pt-br","ko","es","el","pl"]}