---
title: "Django 4.0.1 リリースノート"
version: 6.1
locale: ja
source: https://docs.djangoproject.com/ja/6.1/releases/4.0.1/
canonical: https://djangodocs.dev/ja/6.1/releases/4.0.1/
---
# Django 4.0.1 リリースノート

*2022年1月4日*

Django 4.0.1 では、 4.0 におけるセキュリティの問題のうち深刻度 "medium" 1件、深刻度 "low" 2件を含め、いくつかのバグを修正しました。

## CVE-2021-45115: `UserAttributeSimilarityValidator` におけるサービス拒否攻撃 (DoS) の可能性

[`UserAttributeSimilarityValidator`](/ja/6.1/topics/auth/passwords/#django.contrib.auth.password_validation.UserAttributeSimilarityValidator) incurred significant overhead
evaluating submitted password that were artificially large in relative to the
comparison values. On the assumption that access to user registration was
unrestricted this provided a potential vector for a denial-of-service attack.

In order to mitigate this issue, relatively long values are now ignored by
`UserAttributeSimilarityValidator`.

This issue has severity "medium" according to the [Django security policy](/ja/6.1/internals/security/#severity-levels).

## CVE-2021-45116: `dictsort` テンプレートフィルタ内の潜在的な情報漏洩

Due to leveraging the Django Template Language's variable resolution logic, the
[`dictsort`](/ja/6.1/ref/templates/builtins/#std-templatefilter-dictsort) template filter was potentially vulnerable to information
disclosure or unintended method calls, if passed a suitably crafted key.

In order to avoid this possibility, `dictsort` now works with a restricted
resolution logic, that will not call methods, nor allow indexing on
dictionaries.

As a reminder, all untrusted user input should be validated before use.

This issue has severity "low" according to the [Django security policy](/ja/6.1/internals/security/#severity-levels).

## CVE-2021-45452: `Storage.save()` 経由の潜在的なディレクトリトラバーサル

適切に組み立てられたファイル名が直接渡された場合に、`Storage.save()` がディレクトリトラバーサルを許可してしまっていました。

This issue has severity "low" according to the [Django security policy](/ja/6.1/internals/security/#severity-levels).

## バグ修正

- Django 4.0 において、 `form` という名前のフォームセットに対して `assertFormsetError()` がクラッシュする問題 ([#33346](https://code.djangoproject.com/ticket/33346)) を修正しました。
- Fixed a bug in Django 4.0 that caused a crash on booleans with the
  `RedisCache` backend ([#33361](https://code.djangoproject.com/ticket/33361)).
- Relaxed the check added in Django 4.0 to reallow use of a duck-typed
  `HttpRequest` in `django.views.decorators.cache.cache_control()` and
  `never_cache()` decorators ([#33350](https://code.djangoproject.com/ticket/33350)).
- Fixed a regression in Django 4.0 that caused creating bogus migrations for
  models that reference swappable models such as `auth.User`
  ([#33366](https://code.djangoproject.com/ticket/33366)).
- Fixed a long standing bug in [ジオメトリのコレクション](/ja/6.1/ref/contrib/gis/geos/#geos-geometry-collections) and
  [`Polygon`](/ja/6.1/ref/contrib/gis/geos/#django.contrib.gis.geos.Polygon) that caused a crash on some
  platforms (reported on macOS based on the `ARM64` architecture)
  ([#32600](https://code.djangoproject.com/ticket/32600)).