Django 4.0.1 release notes#

January 4, 2022

Django 4.0.1 fixes one security issue with severity “medium”, two security issues with severity “low”, and several bugs in 4.0.

CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator#

UserAttributeSimilarityValidator incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack.

In order to mitigate this issue, relatively long values are now ignored by UserAttributeSimilarityValidator.

This issue has severity “medium” according to the Django security policy.

CVE-2021-45116: Potential information disclosure in dictsort template filter#

Due to leveraging the Django Template Language’s variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure or unintended method calls, if passed a suitably crafted key.

In order to avoid this possibility, dictsort now works with a restricted resolution logic, that will not call methods, nor allow indexing on dictionaries.

As a reminder, all untrusted user input should be validated before use.

This issue has severity “low” according to the Django security policy.

CVE-2021-45452: Potential directory-traversal via Storage.save()#

Storage.save() allowed directory-traversal if directly passed suitably crafted file names.

This issue has severity “low” according to the Django security policy.

Bugfixes#

  • Fixed a regression in Django 4.0 that caused a crash of assertFormsetError() on a formset named form (#33346).

  • Fixed a bug in Django 4.0 that caused a crash on booleans with the RedisCache backend (#33361).

  • Relaxed the check added in Django 4.0 to reallow use of a duck-typed HttpRequest in django.views.decorators.cache.cache_control() and never_cache() decorators (#33350).

  • Fixed a regression in Django 4.0 that caused creating bogus migrations for models that reference swappable models such as auth.User (#33366).

  • Fixed a long standing bug in Geometry Collections and Polygon that caused a crash on some platforms (reported on macOS based on the ARM64 architecture) (#32600).