... ようにすることを目指した一連の方針を採用し、それに従っています。 セキュリティ問題の報告 ¶ 要約: セキュリティに関する問題は、security@djangoproject.com までメールで報告してください 。 Djangoにおけるほとんどの通常のバグは our public Trac instance に報告され ... は しないでください 。 もし Django に関してセキュリティ上の影響を及ぼすと思われる何かを見つけた場合は、問題の説明をメールで security@djangoproject.com に送ってください。そのアドレスに送られたメールは セキュリティチーム に届きます。 Once you've submitted a ... n issue via email, you should receive an acknowledgment from a member of the security team within 3 working days. After that, the security team will begin their analysis. Depending on the action to be taken, ... ... ドキュメントをそれに応じて更新してください! オーバービュー ¶ There are three types of releases that you might need to make: Security releases: disclosing and fixing a vulnerability. This'll generally involve two or three simultaneous releases -- e.g. 3.2. ... x update (e.g. 4.1.1). Pre-releases: e.g. 4.2 alpha, beta, or rc. The short version of the steps involved is: If this is a security release, pre-notify the security distribution list one week before the actual release. Proofread the release notes, lookin ... lerplate you will need for announcements, CVE publication, and hashes for commit messages. By using this app for preparing security issue metadata, your peer releasers can check your entries and consult them again in the future. See example checklist . P ... ... ようにすることを目指した一連の方針を採用し、それに従っています。 セキュリティ問題の報告 ¶ 要約: セキュリティに関する問題は、security@djangoproject.com までメールで報告してください 。 Djangoにおけるほとんどの通常のバグは our public Trac instance に報告され ... は しないでください 。 もし Django に関してセキュリティ上の影響を及ぼすと思われる何かを見つけた場合は、問題の説明をメールで security@djangoproject.com に送ってください。そのアドレスに送られたメールは セキュリティチーム に届きます。 Once you've submitted a ... n issue via email, you should receive an acknowledgment from a member of the security team within 3 working days. After that, the security team will begin their analysis. Depending on the action to be taken, ... ... ドキュメントをそれに応じて更新してください! オーバービュー ¶ There are three types of releases that you might need to make: Security releases: disclosing and fixing a vulnerability. This'll generally involve two or three simultaneous releases -- e.g. 3.2. ... x update (e.g. 4.1.1). Pre-releases: e.g. 4.2 alpha, beta, or rc. The short version of the steps involved is: If this is a security release, pre-notify the security distribution list one week before the actual release. Proofread the release notes, lookin ... lerplate you will need for announcements, CVE publication, and hashes for commit messages. By using this app for preparing security issue metadata, your peer releasers can check your entries and consult them again in the future. See example checklist . P ... ... tacks by restricting the sources from which content can be loaded. It plays an important role in a comprehensive security strategy . For configuration instructions in a Django project, see the Using CSP documentation. For an HTTP guide about CS ... P, see the MDN Guide on CSP . 概要 ¶ The Content-Security-Policy specification defines two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking conten ... t that violates the defined directives. Content-Security-Policy-Report-Only : Reports CSP violations without blocking content, allowing for non-intrusive testing. Each policy is c ... ... tacks by restricting the sources from which content can be loaded. It plays an important role in a comprehensive security strategy . For configuration instructions in a Django project, see the Using CSP documentation. For an HTTP guide about CS ... P, see the MDN Guide on CSP . 概要 ¶ The Content-Security-Policy specification defines two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking conten ... t that violates the defined directives. Content-Security-Policy-Report-Only : Reports CSP violations without blocking content, allowing for non-intrusive testing. Each policy is c ... ... derate", and one security issue with severity "low" in 4.2.27. CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentica ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... -linear computation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only impleme ... ... derate", and one security issue with severity "low" in 5.2.10. CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentica ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... -linear computation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only impleme ... ... SGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, such a header could be spoofed by supplying a header named with underscores. Under W ... t , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not va ... dated on submission of forged POST data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrect ... ... derate", and one security issue with severity "low" in 4.2.27. CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentica ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... -linear computation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only impleme ... 2026年10月08日