... d only files within the template root directories can be loaded. CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses ¶ URLValidator , validate_ipv4_address() , and validate_ipv46_ad ... t prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. 目次 Django 2.2.24 リ ... ノート CVE-2021-33203: Potential directory traversal via admindocs CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses 前のトピックへ Django 2.2.25 リリースノート 次のトピックへ Djang ... ... d only files within the template root directories can be loaded. CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses ¶ URLValidator , validate_ipv4_address() , and validate_ipv46_ad ... t prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. 目次 Django 3.1.12 リ ... ノート CVE-2021-33203: Potential directory traversal via admindocs CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses 前のトピックへ Django 3.1.13 リリースノート 次のトピックへ Djang ... ... d only files within the template root directories can be loaded. CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses ¶ URLValidator , validate_ipv4_address() , and validate_ipv46_ad ... t prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. 目次 Django 2.2.24 リ ... ノート CVE-2021-33203: Potential directory traversal via admindocs CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses 前のトピックへ Django 2.2.25 リリースノート 次のトピックへ Djang ... ... d only files within the template root directories can be loaded. CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses ¶ URLValidator , validate_ipv4_address() , and validate_ipv46_ad ... t prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. 目次 Django 3.1.12 リ ... ノート CVE-2021-33203: Potential directory traversal via admindocs CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses 前のトピックへ Django 3.1.13 リリースノート 次のトピックへ Djang ... ... d only files within the template root directories can be loaded. CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses ¶ URLValidator , validate_ipv4_address() , and validate_ipv46_ad ... t prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. バグ修正 ¶ Fixed a bu ... ノート CVE-2021-33203: Potential directory traversal via admindocs CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses バグ修正 前のトピックへ Django 3.2.5 リリースノート 次のトピック ... ... sers to click a link which will cause the attacker's JavaScript to be executed by the user's browser. Cross-site scripting attacks can originate from any untrusted source of data, including cookies or web services, if the data are not adequately sanitiz ... ed before being published in a page. Django templates provide protection against the majority of cross-site scripting attacks by automatically escaping characters that represent a risk (that is, HTML characters that could be interpreted by the brow ... rovided by the client to construct URLs in certain cases. While these values are sanitized to prevent cross-site scripting attacks, a fake Host value can be used for cross-site request forgery, cache poisoning attacks, and poisoning links in emails. Bec ... ... sers to click a link which will cause the attacker's JavaScript to be executed by the user's browser. Cross-site scripting attacks can originate from any untrusted source of data, including cookies or web services, if the data are not adequately sanitiz ... ed before being published in a page. Django templates provide protection against the majority of cross-site scripting attacks by automatically escaping characters that represent a risk (that is, HTML characters that could be interpreted by the brow ... rovided by the client to construct URLs in certain cases. While these values are sanitized to prevent cross-site scripting attacks, a fake Host value can be used for cross-site request forgery, cache poisoning attacks, and poisoning links in emails. Bec ... ... d only files within the template root directories can be loaded. CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses ¶ URLValidator , validate_ipv4_address() , and validate_ipv46_ad ... t prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. バグ修正 ¶ Fixed a bu ... ノート CVE-2021-33203: Potential directory traversal via admindocs CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses バグ修正 前のトピックへ Django 3.2.5 リリースノート 次のトピック ... ... dn't prohibit newlines and tabs. If you used values with newlines in HTTP response, you could suffer from header injection attacks. Django itself wasn't vulnerable because HttpResponse prohibits newlines in HTTP headers. Moreover, the URLField form fiel ... ility tabs form リリースノート fixes security Header since accepted input didn prohibit used values response suffer header attacks itself wasn vulnerable クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... dn't prohibit newlines and tabs. If you used values with newlines in HTTP response, you could suffer from header injection attacks. Django itself wasn't vulnerable because HttpResponse prohibits newlines in HTTP headers. Moreover, the URLField form fiel ... ility tabs form リリースノート fixes security Header since accepted input didn prohibit used values response suffer header attacks itself wasn vulnerable クイック検索 Last update: 2026年10月09日 « previous | up | next » ... 2026年10月08日