{"title":"安全问题档案","version":"3.2","locale":"zh-hans","docname":"releases/security","url":"/zh-hans/3.2/releases/security/","canonical":"https://djangodocs.dev/zh-hans/3.2/releases/security/","summary":"Django 的开发团队致力于负责任地报告和披露与安全相关的问题，正如 Django 的安全政策 所概述的那样。 作为该承诺的一部分，我们保留了以下已修复和披露的历史问题清单。对于每个问题，下面的列表包括日期、简要描述、 CVE 标识符 （如果适用）、受影响版本的列表、到完整披露的链接以及到适当补丁的链接。…","html":"

安全问题档案Link to this heading#

\n

Django 的开发团队致力于负责任地报告和披露与安全相关的问题，正如 Django 的安全政策 所概述的那样。

\n

作为该承诺的一部分，我们保留了以下已修复和披露的历史问题清单。对于每个问题，下面的列表包括日期、简要描述、CVE 标识符 （如果适用）、受影响版本的列表、到完整披露的链接以及到适当补丁的链接。

\n

一些重要的注意事项适用于这些信息：

\n\n
\n

Django 的安全流程下的问题Link to this heading#

\n

所有的安全问题都已经在 Django 的安全进程的版本下处理。这些版本列举如下。

\n
\n

March 4, 2024 - CVE 2024-27351Link to this heading#

\n

Potential regular expression denial-of-service in\ndjango.utils.text.Truncator.words(). Full description

\n\n
\n
\n

February 6, 2024 - CVE 2024-24680Link to this heading#

\n

Potential denial-of-service in intcomma template filter.\nFull description

\n\n
\n
\n

November 1, 2023 - CVE 2023-46695Link to this heading#

\n

Potential denial of service vulnerability in UsernameField on Windows.\nFull description

\n\n
\n
\n

October 4, 2023 - CVE 2023-43665Link to this heading#

\n

Denial-of-service possibility in django.utils.text.Truncator.\nFull description

\n\n
\n
\n

September 4, 2023 - CVE 2023-41164Link to this heading#

\n

Potential denial of service vulnerability in\ndjango.utils.encoding.uri_to_iri(). Full description

\n\n
\n
\n

July 3, 2023 - CVE 2023-36053Link to this heading#

\n

Potential regular expression denial of service vulnerability in\nEmailValidator/URLValidator. Full description

\n\n
\n
\n

May 3, 2023 - CVE 2023-31047Link to this heading#

\n

Potential bypass of validation when uploading multiple files using one form\nfield. Full description

\n\n
\n
\n

February 14, 2023 - CVE 2023-24580Link to this heading#

\n

Potential denial-of-service vulnerability in file uploads. Full description

\n\n
\n
\n

February 1, 2023 - CVE 2023-23969Link to this heading#

\n

Potential denial-of-service via Accept-Language headers. Full description

\n\n
\n
\n

October 4, 2022 - CVE 2022-41323Link to this heading#

\n

Potential denial-of-service vulnerability in internationalized URLs. Full\ndescription

\n\n
\n
\n

August 3, 2022 - CVE 2022-36359Link to this heading#

\n

Potential reflected file download vulnerability in FileResponse. Full\ndescription

\n\n
\n
\n

July 4, 2022 - CVE 2022-34265Link to this heading#

\n

Potential SQL injection via Trunc(kind) and Extract(lookup_name)\narguments. Full description

\n\n
\n
\n

April 11, 2022 - CVE 2022-28346Link to this heading#

\n

Potential SQL injection in QuerySet.annotate(), aggregate(), and\nextra(). Full description

\n\n
\n
\n

April 11, 2022 - CVE 2022-28347Link to this heading#

\n

Potential SQL injection via QuerySet.explain(**options) on PostgreSQL.\nFull description

\n\n
\n
\n

February 1, 2022 - CVE 2022-22818Link to this heading#

\n

Possible XSS via {% debug %} template tag. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

February 1, 2022 - CVE 2022-23833Link to this heading#

\n

Denial-of-service possibility in file uploads. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45452Link to this heading#

\n

Potential directory-traversal via Storage.save(). Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45116Link to this heading#

\n

Potential information disclosure in dictsort template filter. Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45115Link to this heading#

\n

Denial-of-service possibility in UserAttributeSimilarityValidator. Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

December 7, 2021 - CVE 2021-44420Link to this heading#

\n

Potential bypass of an upstream access control based on URL paths. Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2021 年 7 月 1 日 - CVE 2021-35042Link to this heading#

\n

潜在的 SQL 注入，通过未检验的 QuerySet.order_by() 输入。完整描述

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2021 年 6 月 2 日 - CVE 2021-33203Link to this heading#

\n

可能通过 admindocs 进行目录遍历。完整描述

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2021 年 6 月 2 日 - CVE 2021-33571Link to this heading#

\n

由于验证器接受 IPv4 地址中的前导零，因此可能出现不确定的 SSRF、RFI 和 LFI 攻击。完整描述

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

May 6, 2021 - CVE 2021-32052Link to this heading#

\n

Header injection possibility since URLValidator accepted newlines in input\non Python 3.9.5+. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2021 年 5 月 4 日 - CVE 2021-31542Link to this heading#

\n

通过上传的文件进行潜在的目录遍历。完整描述

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2021 年 4 月 6 日 - CVE 2021-28658Link to this heading#

\n

通过上传的文件进行潜在的目录遍历。完整描述

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2021 年 2 月 19 日 - CVE 2021-23336Link to this heading#

\n

通过 django.utils.http.limited_parse_qsl() 进行的网络缓存中毒。完整描述。

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2021 年 2 月 1 日 - CVE 2021-3281Link to this heading#

\n

通过 archive.extract() 进行潜在的目录遍历。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2020 年 9 月 1 日 - CVE 2020-24584Link to this heading#

\n

在 Python 3.7+ 上，文件系统缓存的中间层目录的权限升级。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2020 年 9 月 1 日 - CVE 2020-24583Link to this heading#

\n

在 Python 3.7+ 上，中间层目录的权限不正确。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2020 年 6 月 3 日 - CVE 2020-13596Link to this heading#

\n

可能通过管理 ForeignKeyRawIdWidget 进行 XSS。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2020 年 6 月 3 日 - CVE 2020-13254Link to this heading#

\n

通过畸形的 memcached 密钥可能造成数据泄露。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2020 年 3 月 4 日 - CVE 2020-9402Link to this heading#

\n

针对 Oracle 数据库， 通过 GIS 函数和聚合函数中的 tolerance 参数带来的潜在 SQL 注入。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2020 年 2 月 3 日 - CVE 2020-7471Link to this heading#

\n

通过 StringAgg(delimiter) 带来的潜在 SQL 注入。 完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 12 月 18 日 - CVE 2019-19844Link to this heading#

\n

通过密码重置表单带来的潜在账户劫持。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 12 月 2 日 - CVE 2019-19118Link to this heading#

\n

在 Django 管理中的特权提升。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 8 月 1 日 - CVE 2019-14235Link to this heading#

\n

在 django.utils.encoding.uri_to_iri() 函数中潜在的内存耗尽。 完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 8 月 1 日 - CVE 2019-14234Link to this heading#

\n

针对 JSONField ／HStoreField 在键和索引查询时带来的潜在 SQL 注入。 完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 8 月 1 日 - CVE 2019-14233Link to this heading#

\n

存在于 strip_tags() 函数的拒绝服务攻击。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 8 月 1 日 - CVE 2019-14232Link to this heading#

\n

存在于 django.utils.text.Truncator 的拒绝服务攻击。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 7 月 1 日 - CVE 2019-12781Link to this heading#

\n

通过 HTTPS 连接反向代理的 HTTP 检测不正确。。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 6 月 3 日 - CVE 2019-12308Link to this heading#

\n

由 AdminURLFieldWidget 生成的 “Current URL” 连接引起的跨站脚本漏洞。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 6 月 3 日 - CVE 2019-11358Link to this heading#

\n

捆绑 jQuery 的原型污染。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 2 月 11 日 - CVE 2019-6975Link to this heading#

\n

django.utils.numberformat.format() 中内存耗尽。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2019 年 1 月 4 日 - CVE 2019-3498Link to this heading#

\n

默认 404 页面存在内容欺骗的可能。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2018 年 10 月 1 日 - CVE 2018-16984Link to this heading#

\n

密码哈希值披露给了 “只看” 的管理员用户。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2018 年 8 月 1 日 - CVE 2018-14574Link to this heading#

\n

在 CommonMiddleware 中开放重定向的可能性。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2018 年 3 月 6 日 - CVE 2018-7537Link to this heading#

\n

truncatechars_html 和 truncatewords_html 模板过滤器中存在拒绝服务的可能性。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2018 年 3 月 6 日 - CVE 2018-7536Link to this heading#

\n

urlize 和 urlizetrunc 模板过滤器中存在拒绝服务的可能性。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2018 年 2 月 1 日 - CVE 2018-6188Link to this heading#

\n

AuthenticationForm 中的信息泄露。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2017 年 9 月 5 日 - CVE 2017-12794Link to this heading#

\n

在技术 500 调试页面的回溯部分可能存在 XSS。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2017 年 4 月 4 日 - CVE 2017-7234Link to this heading#

\n

django.views.static.service() 中的开放重定向漏洞。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2017 年 4 月 4 日 - CVE 2017-7233Link to this heading#

\n

通过用户提供的数字重定向 URL 打开重定向和可能的 XSS 攻击。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2016 年 11 月 1 日 - CVE 2016-9014Link to this heading#

\n

当 DEBUG=Tr 时，DNS 重绑定漏洞。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2016 年 11 月 1 日 - CVE 2016-9013Link to this heading#

\n

在 Oracle 上运行测试时创建的带有硬编码密码的用户。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2016 年 9 月 26 日 - CVE 2016-7401Link to this heading#

\n

在有 Google Analytics 的网站上绕过 CSRF 保护。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2016 年 7 月 18 日 - CVE 2016-6186Link to this heading#

\n

管理员的添加／更改相关弹窗中的 XSS。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2016 年 3 月 1 日 - CVE 2016-2513Link to this heading#

\n

通过时间差对密码哈希工作因子升级进行用户枚举。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2016 年 3 月 1 日 - CVE 2016-2512Link to this heading#

\n

通过用户提供的包含基本认证的重定向 URL 进行恶意重定向和可能的 XSS 攻击。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2016 年 2 月 1 日 - CVE 2016-2048Link to this heading#

\n

拥有 “变更” 而非 “添加” 权限的用户可以用 “保存为 True” 为 ModelAdmin 创建对象。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

November 24, 2015 - CVE 2015-8213Link to this heading#

\n

Settings leak possibility in date template filter. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

August 18, 2015 - CVE 2015-5963 / CVE 2015-5964Link to this heading#

\n

Denial-of-service possibility in logout() view by filling session store.\nFull description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5145Link to this heading#

\n

Denial-of-service possibility in URL validation. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5144Link to this heading#

\n

Header injection possibility since validators accept newlines in input. Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5143Link to this heading#

\n

Denial-of-service possibility by filling session store. Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

May 20, 2015 - CVE 2015-3982Link to this heading#

\n

Fixed session flushing in the cached_db backend. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

March 18, 2015 - CVE 2015-2317Link to this heading#

\n

Mitigated possible XSS attack via user-supplied redirect URLs. Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

March 18, 2015 - CVE 2015-2316Link to this heading#

\n

Denial-of-service possibility with strip_tags(). Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

March 9, 2015 - CVE 2015-2241Link to this heading#

\n

XSS attack via properties in ModelAdmin.readonly_fields. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0222Link to this heading#

\n

Database denial-of-service with ModelMultipleChoiceField. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0221Link to this heading#

\n

Denial-of-service attack against django.views.static.serve(). Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0220Link to this heading#

\n

Mitigated possible XSS attack via user-supplied redirect URLs. Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0219Link to this heading#

\n

WSGI header spoofing via underscore/dash conflation. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0483Link to this heading#

\n

Data leakage via querystring manipulation in admin.\nFull description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0482Link to this heading#

\n

RemoteUserMiddleware session hijacking. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0481Link to this heading#

\n

File upload denial of service. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0480Link to this heading#

\n

reverse() can generate URLs pointing to other hosts. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

May 18, 2014 - CVE 2014-3730Link to this heading#

\n

Malformed URLs from user input incorrectly validated. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

May 18, 2014 - CVE 2014-1418Link to this heading#

\n

Caches may be allowed to store and serve private data. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0474Link to this heading#

\n

MySQL typecasting causes unexpected query results. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0473Link to this heading#

\n

Caching of anonymous pages could reveal CSRF token. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0472Link to this heading#

\n

Unexpected code execution using reverse(). Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

September 14, 2013 - CVE 2013-1443Link to this heading#

\n

Denial-of-service via large passwords. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

September 10, 2013 - CVE 2013-4315Link to this heading#

\n

Directory-traversal via ssi template tag. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

August 13, 2013 - CVE 2013-6044Link to this heading#

\n

Possible XSS via unvalidated URL redirect schemes. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

August 13, 2013 - CVE 2013-4249Link to this heading#

\n

XSS via admin trusting URLField values. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-0306Link to this heading#

\n

Denial-of-service via formset max_num bypass. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-0305Link to this heading#

\n

Information leakage via admin history log. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-1664 / CVE 2013-1665Link to this heading#

\n

Entity-based attacks against Python XML libraries. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

February 19, 2013 - No CVELink to this heading#

\n

Additional hardening of Host header handling. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

December 10, 2012 - No CVE 2Link to this heading#

\n

Additional hardening of redirect validation. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

December 10, 2012 - No CVE 1Link to this heading#

\n

Additional hardening of Host header handling. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

October 17, 2012 - CVE 2012-4520Link to this heading#

\n

Host header poisoning. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3444Link to this heading#

\n

Denial-of-service via large image files. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3443Link to this heading#

\n

Denial-of-service via compressed image files. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3442Link to this heading#

\n

XSS via failure to validate redirect scheme. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4140Link to this heading#

\n

Potential CSRF via Host header. Full description

\n
\n

受影响的版本Link to this heading#

\n

This notification was an advisory only, so no patches were issued.

\n
    \n

  • Django 1.2

    • \n

  • Django 1.3

    • \n
\n
\n
\n
\n

September 9, 2011 - CVE 2011-4139Link to this heading#

\n

Host header cache poisoning. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4138Link to this heading#

\n

Information leakage/arbitrary request issuance via URLField.verify_exists.\nFull description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4137Link to this heading#

\n

Denial-of-service via URLField.verify_exists. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4136Link to this heading#

\n

Session manipulation when using memory-cache-backed session. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0698Link to this heading#

\n

Directory-traversal on Windows via incorrect path-separator handling. Full\ndescription

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0697Link to this heading#

\n

XSS via unsanitized names of uploaded files. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0696Link to this heading#

\n

CSRF via forged HTTP headers. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

December 22, 2010 - CVE 2010-4535Link to this heading#

\n

Denial-of-service in password-reset mechanism. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

December 22, 2010 - CVE 2010-4534Link to this heading#

\n

Information leakage in administrative interface. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

September 8, 2010 - CVE 2010-3082Link to this heading#

\n

XSS via trusting unsafe cookie value. Full description

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2009 年 10 月 9 日 - CVE 2009-3965Link to this heading#

\n

通过缺陷正则表达性能拒绝服务。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2009 年 7 月 28 日 - CVE 2009-2659Link to this heading#

\n

开发服务器媒体处理程序中的目录遍历。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2008 年 9 月 2 日 - CVE 2008-3909Link to this heading#

\n

在管理员登录时通过保存 POST 数据进行 CSRF。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2008 年 5 月 14 日 - CVE 2008-2302Link to this heading#

\n

通过管理员登录重定向进行 XSS。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2007 年 10 月 26 日 - CVE 2007-5712Link to this heading#

\n

通过任意大的 Accept-Language 头拒绝服务。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n
\n

Django 安全进程之前的问题Link to this heading#

\n

有些安全问题是在 Django 还没有正式使用安全流程之前就已经处理好的。对于这些问题，当时可能还没有发布新的版本，可能还没有分配 CVE。

\n
\n

2007 年 1 月 21 日 - CVE 2007-0405Link to this heading#

\n

对认证用户进行明显的 “缓存”。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
\n

2006 年 8 月 16 日 - CVE 2007-0404Link to this heading#

\n

翻译框架中的文件名验证问题。完整说明

\n
\n

受影响的版本Link to this heading#

\n\n
\n
\n
","rootId":"archive-of-security-issues","toc":[{"title":"Django 的安全流程下的问题","anchor":"issues-under-django-s-security-process","children":[{"title":"March 4, 2024 - CVE 2024-27351","anchor":"march-4-2024-cve-2024-27351","children":[]},{"title":"February 6, 2024 - CVE 2024-24680","anchor":"february-6-2024-cve-2024-24680","children":[]},{"title":"November 1, 2023 - CVE 2023-46695","anchor":"november-1-2023-cve-2023-46695","children":[]},{"title":"October 4, 2023 - CVE 2023-43665","anchor":"october-4-2023-cve-2023-43665","children":[]},{"title":"September 4, 2023 - CVE 2023-41164","anchor":"september-4-2023-cve-2023-41164","children":[]},{"title":"July 3, 2023 - CVE 2023-36053","anchor":"july-3-2023-cve-2023-36053","children":[]},{"title":"May 3, 2023 - CVE 2023-31047","anchor":"may-3-2023-cve-2023-31047","children":[]},{"title":"February 14, 2023 - CVE 2023-24580","anchor":"february-14-2023-cve-2023-24580","children":[]},{"title":"February 1, 2023 - CVE 2023-23969","anchor":"february-1-2023-cve-2023-23969","children":[]},{"title":"October 4, 2022 - CVE 2022-41323","anchor":"october-4-2022-cve-2022-41323","children":[]},{"title":"August 3, 2022 - CVE 2022-36359","anchor":"august-3-2022-cve-2022-36359","children":[]},{"title":"July 4, 2022 - CVE 2022-34265","anchor":"july-4-2022-cve-2022-34265","children":[]},{"title":"April 11, 2022 - CVE 2022-28346","anchor":"april-11-2022-cve-2022-28346","children":[]},{"title":"April 11, 2022 - CVE 2022-28347","anchor":"april-11-2022-cve-2022-28347","children":[]},{"title":"February 1, 2022 - CVE 2022-22818","anchor":"february-1-2022-cve-2022-22818","children":[{"title":"受影响的版本","anchor":"versions-affected","children":[]}]},{"title":"February 1, 2022 - CVE 2022-23833","anchor":"february-1-2022-cve-2022-23833","children":[{"title":"受影响的版本","anchor":"id1","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45452","anchor":"january-4-2022-cve-2021-45452","children":[{"title":"受影响的版本","anchor":"id2","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45116","anchor":"january-4-2022-cve-2021-45116","children":[{"title":"受影响的版本","anchor":"id3","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45115","anchor":"january-4-2022-cve-2021-45115","children":[{"title":"受影响的版本","anchor":"id4","children":[]}]},{"title":"December 7, 2021 - CVE 2021-44420","anchor":"december-7-2021-cve-2021-44420","children":[{"title":"受影响的版本","anchor":"id5","children":[]}]},{"title":"2021 年 7 月 1 日 - CVE 2021-35042","anchor":"july-1-2021-cve-2021-35042","children":[{"title":"受影响的版本","anchor":"id6","children":[]}]},{"title":"2021 年 6 月 2 日 - CVE 2021-33203","anchor":"june-2-2021-cve-2021-33203","children":[{"title":"受影响的版本","anchor":"id7","children":[]}]},{"title":"2021 年 6 月 2 日 - CVE 2021-33571","anchor":"june-2-2021-cve-2021-33571","children":[{"title":"受影响的版本","anchor":"id8","children":[]}]},{"title":"May 6, 2021 - CVE 2021-32052","anchor":"may-6-2021-cve-2021-32052","children":[{"title":"受影响的版本","anchor":"id9","children":[]}]},{"title":"2021 年 5 月 4 日 - CVE 2021-31542","anchor":"may-4-2021-cve-2021-31542","children":[{"title":"受影响的版本","anchor":"id10","children":[]}]},{"title":"2021 年 4 月 6 日 - CVE 2021-28658","anchor":"april-6-2021-cve-2021-28658","children":[{"title":"受影响的版本","anchor":"id11","children":[]}]},{"title":"2021 年 2 月 19 日 - CVE 2021-23336","anchor":"february-19-2021-cve-2021-23336","children":[{"title":"受影响的版本","anchor":"id12","children":[]}]},{"title":"2021 年 2 月 1 日 - CVE 2021-3281","anchor":"february-1-2021-cve-2021-3281","children":[{"title":"受影响的版本","anchor":"id13","children":[]}]},{"title":"2020 年 9 月 1 日 - CVE 2020-24584","anchor":"september-1-2020-cve-2020-24584","children":[{"title":"受影响的版本","anchor":"id14","children":[]}]},{"title":"2020 年 9 月 1 日 - CVE 2020-24583","anchor":"september-1-2020-cve-2020-24583","children":[{"title":"受影响的版本","anchor":"id15","children":[]}]},{"title":"2020 年 6 月 3 日 - CVE 2020-13596","anchor":"june-3-2020-cve-2020-13596","children":[{"title":"受影响的版本","anchor":"id16","children":[]}]},{"title":"2020 年 6 月 3 日 - CVE 2020-13254","anchor":"june-3-2020-cve-2020-13254","children":[{"title":"受影响的版本","anchor":"id17","children":[]}]},{"title":"2020 年 3 月 4 日 - CVE 2020-9402","anchor":"march-4-2020-cve-2020-9402","children":[{"title":"受影响的版本","anchor":"id18","children":[]}]},{"title":"2020 年 2 月 3 日 - CVE 2020-7471","anchor":"february-3-2020-cve-2020-7471","children":[{"title":"受影响的版本","anchor":"id19","children":[]}]},{"title":"2019 年 12 月 18 日 - CVE 2019-19844","anchor":"december-18-2019-cve-2019-19844","children":[{"title":"受影响的版本","anchor":"id20","children":[]}]},{"title":"2019 年 12 月 2 日 - CVE 2019-19118","anchor":"december-2-2019-cve-2019-19118","children":[{"title":"受影响的版本","anchor":"id21","children":[]}]},{"title":"2019 年 8 月 1 日 - CVE 2019-14235","anchor":"august-1-2019-cve-2019-14235","children":[{"title":"受影响的版本","anchor":"id22","children":[]}]},{"title":"2019 年 8 月 1 日 - CVE 2019-14234","anchor":"august-1-2019-cve-2019-14234","children":[{"title":"受影响的版本","anchor":"id23","children":[]}]},{"title":"2019 年 8 月 1 日 - CVE 2019-14233","anchor":"august-1-2019-cve-2019-14233","children":[{"title":"受影响的版本","anchor":"id24","children":[]}]},{"title":"2019 年 8 月 1 日 - CVE 2019-14232","anchor":"august-1-2019-cve-2019-14232","children":[{"title":"受影响的版本","anchor":"id25","children":[]}]},{"title":"2019 年 7 月 1 日 - CVE 2019-12781","anchor":"july-1-2019-cve-2019-12781","children":[{"title":"受影响的版本","anchor":"id26","children":[]}]},{"title":"2019 年 6 月 3 日 - CVE 2019-12308","anchor":"june-3-2019-cve-2019-12308","children":[{"title":"受影响的版本","anchor":"id27","children":[]}]},{"title":"2019 年 6 月 3 日 - CVE 2019-11358","anchor":"june-3-2019-cve-2019-11358","children":[{"title":"受影响的版本","anchor":"id28","children":[]}]},{"title":"2019 年 2 月 11 日 - CVE 2019-6975","anchor":"february-11-2019-cve-2019-6975","children":[{"title":"受影响的版本","anchor":"id29","children":[]}]},{"title":"2019 年 1 月 4 日 - CVE 2019-3498","anchor":"january-4-2019-cve-2019-3498","children":[{"title":"受影响的版本","anchor":"id30","children":[]}]},{"title":"2018 年 10 月 1 日 - CVE 2018-16984","anchor":"october-1-2018-cve-2018-16984","children":[{"title":"受影响的版本","anchor":"id31","children":[]}]},{"title":"2018 年 8 月 1 日 - CVE 2018-14574","anchor":"august-1-2018-cve-2018-14574","children":[{"title":"受影响的版本","anchor":"id32","children":[]}]},{"title":"2018 年 3 月 6 日 - CVE 2018-7537","anchor":"march-6-2018-cve-2018-7537","children":[{"title":"受影响的版本","anchor":"id33","children":[]}]},{"title":"2018 年 3 月 6 日 - CVE 2018-7536","anchor":"march-6-2018-cve-2018-7536","children":[{"title":"受影响的版本","anchor":"id34","children":[]}]},{"title":"2018 年 2 月 1 日 - CVE 2018-6188","anchor":"february-1-2018-cve-2018-6188","children":[{"title":"受影响的版本","anchor":"id35","children":[]}]},{"title":"2017 年 9 月 5 日 - CVE 2017-12794","anchor":"september-5-2017-cve-2017-12794","children":[{"title":"受影响的版本","anchor":"id36","children":[]}]},{"title":"2017 年 4 月 4 日 - CVE 2017-7234","anchor":"april-4-2017-cve-2017-7234","children":[{"title":"受影响的版本","anchor":"id37","children":[]}]},{"title":"2017 年 4 月 4 日 - CVE 2017-7233","anchor":"april-4-2017-cve-2017-7233","children":[{"title":"受影响的版本","anchor":"id38","children":[]}]},{"title":"2016 年 11 月 1 日 - CVE 2016-9014","anchor":"november-1-2016-cve-2016-9014","children":[{"title":"受影响的版本","anchor":"id39","children":[]}]},{"title":"2016 年 11 月 1 日 - CVE 2016-9013","anchor":"november-1-2016-cve-2016-9013","children":[{"title":"受影响的版本","anchor":"id40","children":[]}]},{"title":"2016 年 9 月 26 日 - CVE 2016-7401","anchor":"september-26-2016-cve-2016-7401","children":[{"title":"受影响的版本","anchor":"id41","children":[]}]},{"title":"2016 年 7 月 18 日 - CVE 2016-6186","anchor":"july-18-2016-cve-2016-6186","children":[{"title":"受影响的版本","anchor":"id42","children":[]}]},{"title":"2016 年 3 月 1 日 - CVE 2016-2513","anchor":"march-1-2016-cve-2016-2513","children":[{"title":"受影响的版本","anchor":"id43","children":[]}]},{"title":"2016 年 3 月 1 日 - CVE 2016-2512","anchor":"march-1-2016-cve-2016-2512","children":[{"title":"受影响的版本","anchor":"id44","children":[]}]},{"title":"2016 年 2 月 1 日 - CVE 2016-2048","anchor":"february-1-2016-cve-2016-2048","children":[{"title":"受影响的版本","anchor":"id45","children":[]}]},{"title":"November 24, 2015 - CVE 2015-8213","anchor":"november-24-2015-cve-2015-8213","children":[{"title":"受影响的版本","anchor":"id46","children":[]}]},{"title":"August 18, 2015 - CVE 2015-5963 / CVE 2015-5964","anchor":"august-18-2015-cve-2015-5963-cve-2015-5964","children":[{"title":"受影响的版本","anchor":"id47","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5145","anchor":"july-8-2015-cve-2015-5145","children":[{"title":"受影响的版本","anchor":"id48","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5144","anchor":"july-8-2015-cve-2015-5144","children":[{"title":"受影响的版本","anchor":"id49","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5143","anchor":"july-8-2015-cve-2015-5143","children":[{"title":"受影响的版本","anchor":"id50","children":[]}]},{"title":"May 20, 2015 - CVE 2015-3982","anchor":"may-20-2015-cve-2015-3982","children":[{"title":"受影响的版本","anchor":"id51","children":[]}]},{"title":"March 18, 2015 - CVE 2015-2317","anchor":"march-18-2015-cve-2015-2317","children":[{"title":"受影响的版本","anchor":"id52","children":[]}]},{"title":"March 18, 2015 - CVE 2015-2316","anchor":"march-18-2015-cve-2015-2316","children":[{"title":"受影响的版本","anchor":"id53","children":[]}]},{"title":"March 9, 2015 - CVE 2015-2241","anchor":"march-9-2015-cve-2015-2241","children":[{"title":"受影响的版本","anchor":"id54","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0222","anchor":"january-13-2015-cve-2015-0222","children":[{"title":"受影响的版本","anchor":"id55","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0221","anchor":"january-13-2015-cve-2015-0221","children":[{"title":"受影响的版本","anchor":"id56","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0220","anchor":"january-13-2015-cve-2015-0220","children":[{"title":"受影响的版本","anchor":"id57","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0219","anchor":"january-13-2015-cve-2015-0219","children":[{"title":"受影响的版本","anchor":"id58","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0483","anchor":"august-20-2014-cve-2014-0483","children":[{"title":"受影响的版本","anchor":"id59","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0482","anchor":"august-20-2014-cve-2014-0482","children":[{"title":"受影响的版本","anchor":"id60","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0481","anchor":"august-20-2014-cve-2014-0481","children":[{"title":"受影响的版本","anchor":"id61","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0480","anchor":"august-20-2014-cve-2014-0480","children":[{"title":"受影响的版本","anchor":"id62","children":[]}]},{"title":"May 18, 2014 - CVE 2014-3730","anchor":"may-18-2014-cve-2014-3730","children":[{"title":"受影响的版本","anchor":"id63","children":[]}]},{"title":"May 18, 2014 - CVE 2014-1418","anchor":"may-18-2014-cve-2014-1418","children":[{"title":"受影响的版本","anchor":"id64","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0474","anchor":"april-21-2014-cve-2014-0474","children":[{"title":"受影响的版本","anchor":"id65","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0473","anchor":"april-21-2014-cve-2014-0473","children":[{"title":"受影响的版本","anchor":"id66","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0472","anchor":"april-21-2014-cve-2014-0472","children":[{"title":"受影响的版本","anchor":"id67","children":[]}]},{"title":"September 14, 2013 - CVE 2013-1443","anchor":"september-14-2013-cve-2013-1443","children":[{"title":"受影响的版本","anchor":"id68","children":[]}]},{"title":"September 10, 2013 - CVE 2013-4315","anchor":"september-10-2013-cve-2013-4315","children":[{"title":"受影响的版本","anchor":"id69","children":[]}]},{"title":"August 13, 2013 - CVE 2013-6044","anchor":"august-13-2013-cve-2013-6044","children":[{"title":"受影响的版本","anchor":"id70","children":[]}]},{"title":"August 13, 2013 - CVE 2013-4249","anchor":"august-13-2013-cve-2013-4249","children":[{"title":"受影响的版本","anchor":"id71","children":[]}]},{"title":"February 19, 2013 - CVE 2013-0306","anchor":"february-19-2013-cve-2013-0306","children":[{"title":"受影响的版本","anchor":"id72","children":[]}]},{"title":"February 19, 2013 - CVE 2013-0305","anchor":"february-19-2013-cve-2013-0305","children":[{"title":"受影响的版本","anchor":"id73","children":[]}]},{"title":"February 19, 2013 - CVE 2013-1664 / CVE 2013-1665","anchor":"february-19-2013-cve-2013-1664-cve-2013-1665","children":[{"title":"受影响的版本","anchor":"id74","children":[]}]},{"title":"February 19, 2013 - No CVE","anchor":"february-19-2013-no-cve","children":[{"title":"受影响的版本","anchor":"id75","children":[]}]},{"title":"December 10, 2012 - No CVE 2","anchor":"december-10-2012-no-cve-2","children":[{"title":"受影响的版本","anchor":"id76","children":[]}]},{"title":"December 10, 2012 - No CVE 1","anchor":"december-10-2012-no-cve-1","children":[{"title":"受影响的版本","anchor":"id77","children":[]}]},{"title":"October 17, 2012 - CVE 2012-4520","anchor":"october-17-2012-cve-2012-4520","children":[{"title":"受影响的版本","anchor":"id78","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3444","anchor":"july-30-2012-cve-2012-3444","children":[{"title":"受影响的版本","anchor":"id79","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3443","anchor":"july-30-2012-cve-2012-3443","children":[{"title":"受影响的版本","anchor":"id80","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3442","anchor":"july-30-2012-cve-2012-3442","children":[{"title":"受影响的版本","anchor":"id81","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4140","anchor":"september-9-2011-cve-2011-4140","children":[{"title":"受影响的版本","anchor":"id82","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4139","anchor":"september-9-2011-cve-2011-4139","children":[{"title":"受影响的版本","anchor":"id83","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4138","anchor":"september-9-2011-cve-2011-4138","children":[{"title":"受影响的版本","anchor":"id84","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4137","anchor":"september-9-2011-cve-2011-4137","children":[{"title":"受影响的版本","anchor":"id85","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4136","anchor":"september-9-2011-cve-2011-4136","children":[{"title":"受影响的版本","anchor":"id86","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0698","anchor":"february-8-2011-cve-2011-0698","children":[{"title":"受影响的版本","anchor":"id87","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0697","anchor":"february-8-2011-cve-2011-0697","children":[{"title":"受影响的版本","anchor":"id88","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0696","anchor":"february-8-2011-cve-2011-0696","children":[{"title":"受影响的版本","anchor":"id89","children":[]}]},{"title":"December 22, 2010 - CVE 2010-4535","anchor":"december-22-2010-cve-2010-4535","children":[{"title":"受影响的版本","anchor":"id90","children":[]}]},{"title":"December 22, 2010 - CVE 2010-4534","anchor":"december-22-2010-cve-2010-4534","children":[{"title":"受影响的版本","anchor":"id91","children":[]}]},{"title":"September 8, 2010 - CVE 2010-3082","anchor":"september-8-2010-cve-2010-3082","children":[{"title":"受影响的版本","anchor":"id92","children":[]}]},{"title":"2009 年 10 月 9 日 - CVE 2009-3965","anchor":"october-9-2009-cve-2009-3965","children":[{"title":"受影响的版本","anchor":"id93","children":[]}]},{"title":"2009 年 7 月 28 日 - CVE 2009-2659","anchor":"july-28-2009-cve-2009-2659","children":[{"title":"受影响的版本","anchor":"id94","children":[]}]},{"title":"2008 年 9 月 2 日 - CVE 2008-3909","anchor":"september-2-2008-cve-2008-3909","children":[{"title":"受影响的版本","anchor":"id95","children":[]}]},{"title":"2008 年 5 月 14 日 - CVE 2008-2302","anchor":"may-14-2008-cve-2008-2302","children":[{"title":"受影响的版本","anchor":"id96","children":[]}]},{"title":"2007 年 10 月 26 日 - CVE 2007-5712","anchor":"october-26-2007-cve-2007-5712","children":[{"title":"受影响的版本","anchor":"id97","children":[]}]}]},{"title":"Django 安全进程之前的问题","anchor":"issues-prior-to-django-s-security-process","children":[{"title":"2007 年 1 月 21 日 - CVE 2007-0405","anchor":"january-21-2007-cve-2007-0405","children":[{"title":"受影响的版本","anchor":"id98","children":[]}]},{"title":"2006 年 8 月 16 日 - CVE 2007-0404","anchor":"august-16-2006-cve-2007-0404","children":[{"title":"受影响的版本","anchor":"id99","children":[]}]}]}],"breadcrumbs":[{"docname":"releases/index","title":"发行说明","url":"/zh-hans/3.2/releases/"}],"prev":{"docname":"releases/0.95","title":"Django 0.95 版本发行说明","url":"/zh-hans/3.2/releases/0.95/"},"next":{"docname":"internals/index","title":"Django internals","url":"/zh-hans/3.2/internals/"},"formats":{"html":"/zh-hans/3.2/releases/security/","markdown":"/zh-hans/3.2/releases/security.md","json":"/zh-hans/3.2/releases/security.json"},"source":"https://github.com/django/django/blob/stable/3.2.x/docs/releases/security.txt","official":"https://docs.djangoproject.com/zh-hans/3.2/releases/security/","inVersions":["6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0"],"inLocales":["en","zh-hans","fr","ja","id","it","pt-br","ko","es","el","pl"]}