---
title: "Django 2.0.2 release notes"
version: 6.0
locale: ko
source: https://docs.djangoproject.com/ko/6.0/releases/2.0.2/
canonical: https://djangodocs.dev/ko/6.0/releases/2.0.2/
---
# Django 2.0.2 release notes

*February 1, 2018*

Django 2.0.2 fixes a security issue and several bugs in 2.0.1.

## CVE-2018-6188: Information leakage in `AuthenticationForm`

A regression in Django 1.11.8 made
[`AuthenticationForm`](/ko/6.0/topics/auth/default/#django.contrib.auth.forms.AuthenticationForm) run its
`confirm_login_allowed()` method even if an incorrect password is entered.
This can leak information about a user, depending on what messages
`confirm_login_allowed()` raises. If `confirm_login_allowed()` isn’t
overridden, an attacker enter an arbitrary username and see if that user has
been set to `is_active=False`. If `confirm_login_allowed()` is overridden,
more sensitive details could be leaked.

This issue is fixed with the caveat that `AuthenticationForm` can no longer
raise the “This account is inactive.” error if the authentication backend
rejects inactive users (the default authentication backend, `ModelBackend`,
has done that since Django 1.10). This issue will be revisited for Django 2.1
as a fix to address the caveat will likely be too invasive for inclusion in
older versions.

## 버그 수정

- Fixed hidden content at the bottom of the “The install worked successfully!”
  page for some languages ([#28885](https://code.djangoproject.com/ticket/28885)).
- Fixed incorrect foreign key nullification if a model has two foreign keys to
  the same model and a target model is deleted ([#29016](https://code.djangoproject.com/ticket/29016)).
- Fixed regression in the use of `QuerySet.values_list(..., flat=True)`
  followed by `annotate()` ([#29067](https://code.djangoproject.com/ticket/29067)).
- Fixed a regression where a queryset that annotates with geometry objects
  crashes ([#29054](https://code.djangoproject.com/ticket/29054)).
- Fixed a regression where `contrib.auth.authenticate()` crashes if an
  authentication backend doesn’t accept `request` and a later one does
  ([#29071](https://code.djangoproject.com/ticket/29071)).
- Fixed a regression where `makemigrations` crashes if a migrations directory
  doesn’t have an `__init__.py` file ([#29091](https://code.djangoproject.com/ticket/29091)).
- Fixed crash when entering an invalid uuid in `ModelAdmin.raw_id_fields`
  ([#29094](https://code.djangoproject.com/ticket/29094)).