1. ===========================

  2. Django 2.2.13 release notes

  3. ===========================

  4. 

  5. *June 3, 2020*

  6. 

  7. Django 2.2.13 fixes two security issues and a regression in 2.2.12.

  8. 

  9. CVE-2020-13254: Potential data leakage via malformed memcached keys

  10. ===================================================================

  11. 

  12. In cases where a memcached backend does not perform key validation, passing

  13. malformed cache keys could result in a key collision, and potential data

  14. leakage. In order to avoid this vulnerability, key validation is added to the

  15. memcached cache backends.

  16. 

  17. CVE-2020-13596: Possible XSS via admin ``ForeignKeyRawIdWidget``

  18. ================================================================

  19. 

  20. Query parameters for the admin ``ForeignKeyRawIdWidget`` were not properly URL

  21. encoded, posing an XSS attack vector. ``ForeignKeyRawIdWidget`` now

  22. ensures query parameters are correctly URL encoded.

  23. 

  24. Bugfixes

  25. ========

  26. 

  27. * Fixed a regression in Django 2.2.12 that affected translation loading for

  28.   apps providing translations for territorial language variants as well as a

  29.   generic language, where the project has different plural equations for the

  30.   language (:ticket:`31570`).

  31. 

  32. * Tracking a jQuery security release, upgraded the version of jQuery used by

  33.   the admin from 3.3.1 to 3.5.1.
About Sign Up Leave Feedback Contact