mirror of
https://github.com/django/django.git
synced 2026-02-09 02:49:25 +08:00
69065ca869
Before, `order_by()` treated a period in a field name as a sign that it was requested via `.extra(order_by=...)` and thus should be passed through as raw table and column names, even if `extra()` was not used. Since periods are permitted in aliases, this meant user-controlled aliases could force the `order_by()` clause to resolve to a raw table and column pair instead of the actual target field for the alias. In practice, only `FilteredRelation` was affected, as the other expressions we tested, e.g. `F`, aggressively optimize away the ordering expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY "table".column. Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard for reviews.
93 lines
4.2 KiB
Plaintext
93 lines
4.2 KiB
Plaintext
==========================
|
|
Django 6.0.2 release notes
|
|
==========================
|
|
|
|
*February 3, 2026*
|
|
|
|
Django 6.0.2 fixes three security issues with severity "high", two security
|
|
issues with severity "moderate", one security issue with severity "low", and
|
|
several bugs in 6.0.1.
|
|
|
|
CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler
|
|
=================================================================================================
|
|
|
|
The ``django.contrib.auth.handlers.modwsgi.check_password()`` function for
|
|
:doc:`authentication via mod_wsgi</howto/deployment/wsgi/apache-auth>`
|
|
allowed remote attackers to enumerate users via a timing attack.
|
|
|
|
This issue has severity "low" according to the :ref:`Django security policy
|
|
<security-disclosure>`.
|
|
|
|
CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI
|
|
==============================================================================================
|
|
|
|
When receiving duplicates of a single header, ``ASGIRequest`` allowed a remote
|
|
attacker to cause a potential denial-of-service via a specifically created
|
|
request with multiple duplicate headers. The vulnerability resulted from
|
|
repeated string concatenation while combining repeated headers, which
|
|
produced super-linear computation resulting in service degradation or outage.
|
|
|
|
This issue has severity "moderate" according to the :ref:`Django security
|
|
policy <security-disclosure>`.
|
|
|
|
CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS
|
|
====================================================================
|
|
|
|
:ref:`Raster lookups <spatial-lookup-raster>` on GIS fields (only implemented
|
|
on PostGIS) were subject to SQL injection if untrusted data was used as a band
|
|
index.
|
|
|
|
As a reminder, all untrusted user input should be validated before use.
|
|
|
|
This issue has severity "high" according to the :ref:`Django security policy
|
|
<security-disclosure>`.
|
|
|
|
CVE-2026-1285: Potential denial-of-service vulnerability in ``django.utils.text.Truncator`` HTML methods
|
|
========================================================================================================
|
|
|
|
``django.utils.text.Truncator.chars()`` and ``Truncator.words()`` methods (with
|
|
``html=True``) and the :tfilter:`truncatechars_html` and
|
|
:tfilter:`truncatewords_html` template filters were subject to a potential
|
|
denial-of-service attack via certain inputs with a large number of unmatched
|
|
HTML end tags, which could cause quadratic time complexity during HTML parsing.
|
|
|
|
This issue has severity "moderate" according to the :ref:`Django security
|
|
policy <security-disclosure>`.
|
|
|
|
CVE-2026-1287: Potential SQL injection in column aliases via control characters
|
|
===============================================================================
|
|
|
|
:class:`.FilteredRelation` was subject to SQL injection in column aliases via
|
|
control characters, using a suitably crafted dictionary, with dictionary
|
|
expansion, as the ``**kwargs`` passed to :meth:`.QuerySet.annotate`,
|
|
:meth:`~.QuerySet.aggregate`, :meth:`~.QuerySet.extra`,
|
|
:meth:`~.QuerySet.values`, :meth:`~.QuerySet.values_list`, and
|
|
:meth:`~.QuerySet.alias`.
|
|
|
|
This issue has severity "high" according to the :ref:`Django security policy
|
|
<security-disclosure>`.
|
|
|
|
CVE-2026-1312: Potential SQL injection via ``QuerySet.order_by`` and ``FilteredRelation``
|
|
=========================================================================================
|
|
|
|
:meth:`.QuerySet.order_by` was subject to SQL injection in column aliases
|
|
containing periods when the same alias was, using a suitably crafted
|
|
dictionary, with dictionary expansion, used in :class:`.FilteredRelation`.
|
|
|
|
This issue has severity "high" according to the :ref:`Django security policy
|
|
<security-disclosure>`.
|
|
|
|
Bugfixes
|
|
========
|
|
|
|
* Fixed a visual regression in Django 6.0 that caused the admin filter sidebar
|
|
to wrap below the changelist when filter elements contained long text
|
|
(:ticket:`36850`).
|
|
|
|
* Fixed a visual regression in Django 6.0 for admin form fields grouped under a
|
|
``<fieldset>`` aligned horizontally (:ticket:`36788`).
|
|
|
|
* Fixed a regression in Django 6.0 where ``auto_now_add`` field values were not
|
|
populated during ``INSERT`` operations, due to incorrect parameters passed to
|
|
``field.pre_save()`` (:ticket:`36847`).
|