1. ==========================

  2. Django 3.0.7 release notes

  3. ==========================

  4. 

  5. *June 3, 2020*

  6. 

  7. Django 3.0.7 fixes two security issues and several bugs in 3.0.6.

  8. 

  9. CVE-2020-13254: Potential data leakage via malformed memcached keys

  10. ===================================================================

  11. 

  12. In cases where a memcached backend does not perform key validation, passing

  13. malformed cache keys could result in a key collision, and potential data

  14. leakage. In order to avoid this vulnerability, key validation is added to the

  15. memcached cache backends.

  16. 

  17. CVE-2020-13596: Possible XSS via admin ``ForeignKeyRawIdWidget``

  18. ================================================================

  19. 

  20. Query parameters for the admin ``ForeignKeyRawIdWidget`` were not properly URL

  21. encoded, posing an XSS attack vector. ``ForeignKeyRawIdWidget`` now

  22. ensures query parameters are correctly URL encoded.

  23. 

  24. Bugfixes

  25. ========

  26. 

  27. * Fixed a regression in Django 3.0 by restoring the ability to use field

  28.   lookups in ``Meta.ordering`` (:ticket:`31538`).

  29. 

  30. * Fixed a regression in Django 3.0 where ``QuerySet.values()`` and

  31.   ``values_list()`` crashed if a queryset contained an aggregation and a

  32.   subquery annotation (:ticket:`31566`).

  33. 

  34. * Fixed a regression in Django 3.0 where aggregates used wrong annotations when

  35.   a queryset has multiple subqueries annotations (:ticket:`31568`).

  36. 

  37. * Fixed a regression in Django 3.0 where ``QuerySet.values()`` and

  38.   ``values_list()`` crashed if a queryset contained an aggregation and an

  39.   ``Exists()`` annotation on Oracle (:ticket:`31584`).

  40. 

  41. * Fixed a regression in Django 3.0 where all resolved ``Subquery()``

  42.   expressions were considered equal (:ticket:`31607`).

  43. 

  44. * Fixed a regression in Django 3.0.5 that affected translation loading for apps

  45.   providing translations for territorial language variants as well as a generic

  46.   language, where the project has different plural equations for the language

  47.   (:ticket:`31570`).

  48. 

  49. * Tracking a jQuery security release, upgraded the version of jQuery used by

  50.   the admin from 3.4.1 to 3.5.1.
About Sign Up Leave Feedback Contact