1. ===========================

  2. Django 3.1.13 release notes

  3. ===========================

  4. 

  5. *July 1, 2021*

  6. 

  7. Django 3.1.13 fixes a security issue with severity "high" in 3.1.12.

  8. 

  9. CVE-2021-35042: Potential SQL injection via unsanitized ``QuerySet.order_by()`` input

  10. =====================================================================================

  11. 

  12. Unsanitized user input passed to ``QuerySet.order_by()`` could bypass intended

  13. column reference validation in path marked for deprecation resulting in a

  14. potential SQL injection even if a deprecation warning is emitted.

  15. 

  16. As a mitigation the strict column reference validation was restored for the

  17. duration of the deprecation period. This regression appeared in 3.1 as a side

  18. effect of fixing :ticket:`31426`.

  19. 

  20. The issue is not present in the main branch as the deprecated path has been

  21. removed.
About Sign Up Leave Feedback Contact