Django的开发小组坚定地承诺，为报告和公开安全相关问题负责，这在Django的安全问题中列出。

对于每个问题，下面的列表包含日期、简短的描述、CVE 标识符、受影响的版本列表、完整的页面链接以及相应补丁的连接。

有一些重要的附加说明：

一些安全问题在Django具有规范化的安全处理流程之前被修复。

对于这些问题，可能不会发布新的发行版，也不会分配CVE。CVE-2007-0404: 翻译框架中的文件名验证问题。

Full description

  • CVE-2007-0405: 已认证用户的可见“缓存”。Full description
  • 所有其它的安全问题都已经在Django安全处理流程下的版本中解决。下面会列出来：

CVE-2007-5712: 通过任意大尺寸Accept-Language协议头的拒绝服务攻击。

Full descriptionCVE-2008-2302: 通过admin登录重定向的XSS。

Full description

CVE-2008-3909: 通过在admin登录状态下保存POST数据的CSRF。Full description

CVE-2009-2659: 开发服务器的媒体处理器上的拒绝服务攻击。

CVE-2010-3082: 通过不安全cookie值的XSS。

Full descriptionCVE-2010-4534: 管理界面上的信息泄露。

Full description

Full description

CVE-2011-0696: 通过伪造HTTP协议头的XSS。Full description

CVE-2011-0697: 通过未检查的名称或者上传文件的XSS。

Full descriptionCVE-2011-0698: Windows上通过不正确的目录分隔符处理的目录遍历。

Full description

Full description

CVE-2011-4138: 通过URLField.verify_exists的信息泄露/任何请求发布。Full description

CVE-2011-4139: Host协议头缓存污染。

这个通知只是一个公告，没有任何补丁发布。

CVE-2012-3442: 通过验证重定向模式失败的XSS。Full description

CVE-2012-3443: 通过压缩的图像文件的拒绝服务u攻击。

CVE-2012-4520: Host协议头污染。

Full description对Host协议头处理的额外加固。

Full description

对Host协议头处理的额外加固。

Full descriptionCVE-2013-1664 and CVE-2013-1665: 对Python XML库的基于实体的攻击。

Full description

CVE-2013-0306: 通过表单集max_num 的拒绝服务攻击。

Full description(CVE not yet issued): 通过admin受信任的URLField值的XSS。

Full description

  • (CVE not yet issued):可能的XSS漏洞，通过未验证的URL重定向模式。

Full description

CVE-2013-4315 通过ssi模板标签的目录遍历。

Full description

CVE-2014-0472: 使用reverse()的非预期代码执行。

Full descriptionCVE-2014-0473: 匿名页面的缓存可能会泄露CSRF标识。

Full description

CVE-2014-1418: 缓存可能允许存储和处理私人数据。

Full descriptionCVE-2014-3730: 来源于用户输入的错误格式URL的不正确验证。

Full description

CVE-2014-0481: 文件上传的拒绝服务攻击。

Full descriptionCVE-2014-0482: RemoteUserMiddleware会话劫持。

Full description

CVE-2015-0219: 通过下划线或者破折号合并产生的WSGI协议头欺骗。

Full descriptionCVE-2015-0220:  通过用户提供的重定向URL的可能的XSS攻击。

Full description

CVE-2015-0222: 使用ModelMultipleChoiceField的数据库拒绝服务攻击。

Full description Enter search terms or a module, class or function name.

May 13, 2015

  • Django 1.8.2 文档
  • 安全问题归档

August 16, 2006 - CVE-2007-0404

January 21, 2007 - CVE-2007-0405October 26, 2007 - CVE-2007-5712

May 14, 2008 - CVE-2008-2302

  • September 2, 2008 - CVE-2008-3909
  • July 28, 2009 - CVE-2009-2659

October 9, 2009 - CVE-2009-3965

September 8, 2010 - CVE-2010-3082December 22, 2010 - CVE-2010-4534

December 22, 2010 - CVE-2010-4535

  • February 8, 2011 - CVE-2011-0696
  • February 8, 2011 - CVE-2011-0697

February 8, 2011 - CVE-2011-0698

September 9, 2011 - CVE-2011-4136September 9, 2011 - CVE-2011-4137

September 9, 2011 - CVE-2011-4138

  • September 9, 2011 - CVE-2011-4139
  • September 9, 2011 - CVE-2011-4140

July 30, 2012 - CVE-2012-3442

July 30, 2012 - CVE-2012-3443July 30, 2012 - CVE-2012-3444

October 17, 2012 - CVE-2012-4520

December 10, 2012 - No CVE 1

  • December 10, 2012 - No CVE 2
  • February 19, 2013 - No CVE

February 19, 2013 - CVE-2013-1664/1665

February 19, 2013 - CVE-2013-0305February 19, 2013 - CVE-2013-0306

August 13, 2013 - Awaiting CVE 1

  • August 13, 2013 - Awaiting CVE 2
  • September 10, 2013 - CVE-2013-4315

September 14, 2013 - CVE-2013-1443

April 21, 2014 - CVE-2014-0472April 21, 2014 - CVE-2014-0473

April 21, 2014 - CVE-2014-0474

  • May 18, 2014 - CVE-2014-1418
  • May 18, 2014 - CVE-2014-3730

August 20, 2014 - CVE-2014-0480

August 20, 2014 - CVE-2014-0481August 20, 2014 - CVE-2014-0482

August 20, 2014 - CVE-2014-0483

  • January 13, 2015 - CVE-2015-0219
  • January 13, 2015 - CVE-2015-0220

January 13, 2015 - CVE-2015-0221

January 13, 2015 - CVE-2015-0222Table Of Contents

Browse

  • You are here:
  • This Page

Quick search

Last update:Versions affected

Versions affected

  • Versions affected
  • Versions affected

Versions affected

Versions affectedVersions affected

Versions affected

  • Versions affected
  • Versions affected

Versions affected

Versions affectedVersions affected

Versions affected

  • Versions affected
  • Versions affected

Versions affected

Versions affectedVersions affected

Versions affected

  • Versions affected
  • Versions affected

Versions affected

Versions affectedVersions affected

Versions affected

  • Versions affected
  • Versions affected

Versions affected

Versions affectedVersions affected

Versions affected

  • Versions affected
  • Versions affected

Versions affected

Versions affectedVersions affected

Versions affected

  • Versions affected

Versions affected

Versions affectedVersions affected

Versions affected

  • Versions affected
  • Versions affected

列出的受影响版本只包含了在漏洞公开时期的Django稳定的安全支持发行版。

这意味着，老的版本（安全支持已经过期），以及预发行版本（alpha/beta/RC）在漏洞公开的时期也可能会受影响，但是没有列出。Django项目偶尔会发布安全公告，指出潜在的安全问题，可能会由不合理的配置或其他Django本身以外的问题产生。

这些公告中有一些收到了CVE；

  • 这种情况下，它们会在这里列出来，但是没有任何附加的补丁或者发行版，只有描述、公开信息和CVE。
  • Django 0.90 (patch)

Django 0.91 (patch)

Django 0.95 (patch) (released January 21 2007)Django 0.95 (patch)

Django 0.91 (patch)

Django 0.91 (patch)

Django 0.95 (patch)Django 0.96 (patch)

Django 0.91 (patch)

Django 1.0 (patch)

Django 1.1 (patch)Django 1.2 (patch)

Django 1.1 (patch)

Django 1.2 (patch)

Django 1.1 (patch)Django 1.2 (patch)

Django 1.1 (patch)

Django 1.3 (patch)

Django 1.2: (patch)Django 1.3: (patch)

Django 1.2 (patch)

Django 1.4: (patch)

Django 1.3: (patch)Django 1.4: (patch)

Django 1.3 (patch)

Django 1.4 (patch)

Django 1.3: (patch)Django 1.4: (patch)

Django 1.3 (patch)

Django 1.4 (patch)

Django 1.3 (patch)Django 1.4 (patch)

Django 1.5 (patch)

Django 1.4 (patch and Python compatibility fix)

Django 1.5 (patch)Django 1.4 (patch)

Django 1.5 (patch)

Django 1.6 (patch)

Django 1.7 (patch)Django 1.4 (patch)

Django 1.5 (patch)

Django 1.6 (patch)

Django 1.7 (patch)Django 1.4 (patch)

Django 1.5 (patch)

Django 1.5 (patch)

Django 1.6 (patch)Django 1.7 (patch)

Django 1.4 (patch)

Django 1.4 (patch)

Django 1.5 (patch)Django 1.6 (patch)

Django 1.7 (patch)

Django 1.7 (patch)

Django 1.4 (patch)Django 1.6 (patch)

Django 1.7 (patch)