說明Django中的安全問題 · Django 中文文檔 1.8

# 安全問題歸檔 Django的開發小組堅定地承諾，為報告和公開安全相關問題負責，這在[_Django的安全問題_](../internals/security.html)中列出。作為承諾的一部分，我們保留了下面的問題的歷史列表，這些問題已經被解決和公開。對于每個問題，下面的列表包含日期、簡短的描述、[CVE 標識符](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)、受影響的版本列表、完整的頁面鏈接以及相應補丁的連接。有一些重要的附加說明： * 列出的受影響版本只包含了在漏洞公開時期的Django穩定的安全支持發行版。這意味著，老的版本（安全支持已經過期），以及預發行版本（alpha/beta/RC）在漏洞公開的時期也可能會受影響，但是沒有列出。 * Django項目偶爾會發布安全公告，指出潛在的安全問題，可能會由不合理的配置或其他Django本身以外的問題產生。這些公告中有一些收到了CVE；這種情況下，它們會在這里列出來，但是沒有任何附加的補丁或者發行版，只有描述、公開信息和CVE。 ## Issues prior to Django’s security process 一些安全問題在Django具有規范化的安全處理流程之前被修復。對于這些問題，可能不會發布新的發行版，也不會分配CVE。 ### August 16, 2006 - CVE-2007-0404 [CVE-2007-0404](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0404&cid=3): 翻譯框架中的文件名驗證問題。[Full description](https://www.djangoproject.com/weblog/2006/aug/16/compilemessages/) #### Versions affected * Django 0.90 [(patch)](https://github.com/django/django/commit/518d406e53) * Django 0.91 [(patch)](https://github.com/django/django/commit/518d406e53) * Django 0.95 [(patch)](https://github.com/django/django/commit/a132d411c6) (released January 21 2007) ### January 21, 2007 - CVE-2007-0405 [CVE-2007-0405](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0405&cid=3): 已認證用戶的可見“緩存”。[Full description](https://www.djangoproject.com/weblog/2007/jan/21/0951/) #### Versions affected * Django 0.95 [(patch)](https://github.com/django/django/commit/e89f0a6558) ## Issues under Django’s security process 所有其它的安全問題都已經在Django安全處理流程下的版本中解決。下面會列出來： ### October 26, 2007 - CVE-2007-5712 [CVE-2007-5712](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5712&cid=3): 通過任意大尺寸`Accept-Language`協議頭的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2007/oct/26/security-fix/) #### Versions affected * Django 0.91 [(patch)](https://github.com/django/django/commit/8bc36e726c9e8c75c681d3ad232df8e882aaac81) * Django 0.95 [(patch)](https://github.com/django/django/commit/412ed22502e11c50dbfee854627594f0e7e2c234) * Django 0.96 [(patch)](https://github.com/django/django/commit/7dd2dd08a79e388732ce00e2b5514f15bd6d0f6f) ### May 14, 2008 - CVE-2008-2302 [CVE-2008-2302](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2302&cid=3): 通過admin登錄重定向的XSS。[Full description](https://www.djangoproject.com/weblog/2008/may/14/security/) #### Versions affected * Django 0.91 [(patch)](https://github.com/django/django/commit/50ce7fb57d) * Django 0.95 [(patch)](https://github.com/django/django/commit/50ce7fb57d) * Django 0.96 [(patch)](https://github.com/django/django/commit/7791e5c050) ### September 2, 2008 - CVE-2008-3909 [CVE-2008-3909](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3909&cid=3): 通過在admin登錄狀態下保存POST數據的CSRF。[Full description](https://www.djangoproject.com/weblog/2008/sep/02/security/) #### Versions affected * Django 0.91 [(patch)](https://github.com/django/django/commit/44debfeaa4473bd28872c735dd3d9afde6886752) * Django 0.95 [(patch)](https://github.com/django/django/commit/aee48854a164382c655acb9f18b3c06c3d238e81) * Django 0.96 [(patch)](https://github.com/django/django/commit/7e0972bded362bc4b851c109df2c8a6548481a8e) ### July 28, 2009 - CVE-2009-2659 [CVE-2009-2659](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2659&cid=3): 開發服務器的媒體處理器上的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2009/jul/28/security/) #### Versions affected * Django 0.96 [(patch)](https://github.com/django/django/commit/da85d76fd6) * Django 1.0 [(patch)](https://github.com/django/django/commit/df7f917b7f) ### October 9, 2009 - CVE-2009-3965 [CVE-2009-3965](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3695&cid=3): 通過執行異常正則表達式的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2009/oct/09/security/) #### Versions affected * Django 1.0 [(patch)](https://github.com/django/django/commit/594a28a904) * Django 1.1 [(patch)](https://github.com/django/django/commit/e3e992e18b) ### September 8, 2010 - CVE-2010-3082 [CVE-2010-3082](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3082&cid=3): 通過不安全cookie值的XSS。[Full description](https://www.djangoproject.com/weblog/2010/sep/08/security-release/) #### Versions affected * Django 1.2 [(patch)](https://github.com/django/django/commit/7f84657b6b) ### December 22, 2010 - CVE-2010-4534 [CVE-2010-4534](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4534&cid=3): 管理界面上的信息泄露。[Full description](https://www.djangoproject.com/weblog/2010/dec/22/security/) #### Versions affected * Django 1.1 [(patch)](https://github.com/django/django/commit/17084839fd) * Django 1.2 [(patch)](https://github.com/django/django/commit/85207a245b) ### December 22, 2010 - CVE-2010-4535 [CVE-2010-4535](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4535&cid=2): 密碼重置機制上的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2010/dec/22/security/) #### Versions affected * Django 1.1 [(patch)](https://github.com/django/django/commit/7f8dd9cbac) * Django 1.2 [(patch)](https://github.com/django/django/commit/d5d8942a16) ### February 8, 2011 - CVE-2011-0696 [CVE-2011-0696](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0696&cid=2): 通過偽造HTTP協議頭的XSS。[Full description](https://www.djangoproject.com/weblog/2011/feb/08/security/) #### Versions affected * Django 1.1 [(patch)](https://github.com/django/django/commit/408c5c873c) * Django 1.2 [(patch)](https://github.com/django/django/commit/818e70344e) ### February 8, 2011 - CVE-2011-0697 [CVE-2011-0697](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0697&cid=2): 通過未檢查的名稱或者上傳文件的XSS。[Full description](https://www.djangoproject.com/weblog/2011/feb/08/security/) #### Versions affected * Django 1.1 [(patch)](https://github.com/django/django/commit/1966786d2d) * Django 1.2 [(patch)](https://github.com/django/django/commit/1f814a9547) ### February 8, 2011 - CVE-2011-0698 [CVE-2011-0698](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0698&cid=2): Windows上通過不正確的目錄分隔符處理的目錄遍歷。[Full description](https://www.djangoproject.com/weblog/2011/feb/08/security/) #### Versions affected * Django 1.1 [(patch)](https://github.com/django/django/commit/570a32a047) * Django 1.2 [(patch)](https://github.com/django/django/commit/194566480b) ### September 9, 2011 - CVE-2011-4136 [CVE-2011-4136](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4136&cid=2):使用memory-cache-backed會話時的會話操縱。[Full description](https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/) #### Versions affected * Django 1.2 [(patch)](https://github.com/django/django/commit/ac7c3a110f) * Django 1.3 [(patch)](https://github.com/django/django/commit/fbe2eead2f) ### September 9, 2011 - CVE-2011-4137 [CVE-2011-4137](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4137&cid=2): 通過`URLField.verify_exists`的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/) #### Versions affected * Django 1.2 [(patch)](https://github.com/django/django/commit/7268f8af86) * Django 1.3 [(patch)](https://github.com/django/django/commit/1a76dbefdf) ### September 9, 2011 - CVE-2011-4138 [CVE-2011-4138](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4138&cid=2): 通過`URLField.verify_exists`的信息泄露/任何請求發布。[Full description](https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/) #### Versions affected * Django 1.2: [(patch)](https://github.com/django/django/commit/7268f8af86) * Django 1.3: [(patch)](https://github.com/django/django/commit/1a76dbefdf) ### September 9, 2011 - CVE-2011-4139 [CVE-2011-4139](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4139&cid=2): `Host`協議頭緩存污染。 [Full description](https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/) #### Versions affected * Django 1.2 [(patch)](https://github.com/django/django/commit/c613af4d64) * Django 1.3 [(patch)](https://github.com/django/django/commit/2f7fadc38e) ### September 9, 2011 - CVE-2011-4140 [CVE-2011-4140](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4140&cid=2):通過`Host`協議頭的潛在CSRF威脅。[Full description](https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/) #### Versions affected 這個通知只是一個公告，沒有任何補丁發布。 * Django 1.2 * Django 1.3 ### July 30, 2012 - CVE-2012-3442 [CVE-2012-3442](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3442&cid=2): 通過驗證重定向模式失敗的XSS。[Full description](https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/) #### Versions affected * Django 1.3: [(patch)](https://github.com/django/django/commit/4dea4883e6c50d75f215a6b9bcbd95273f57c72d) * Django 1.4: [(patch)](https://github.com/django/django/commit/e34685034b60be1112160e76091e5aee60149fa1) ### July 30, 2012 - CVE-2012-3443 [CVE-2012-3443](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3443&cid=2): 通過壓縮的圖像文件的拒絕服務u攻擊。[Full description](https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/) #### Versions affected * Django 1.3: [(patch)](https://github.com/django/django/commit/b2eb4787a0fff9c9993b78be5c698e85108f3446) * Django 1.4: [(patch)](https://github.com/django/django/commit/c14f325c4eef628bc7bfd8873c3a72aeb0219141) ### July 30, 2012 - CVE-2012-3444 [CVE-2012-3444](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3444&cid=2):通過大尺寸圖像文件的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/) #### Versions affected * Django 1.3 [(patch)](https://github.com/django/django/commit/9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155) * Django 1.4 [(patch)](https://github.com/django/django/commit/da33d67181b53fe6cc737ac1220153814a1509f6) ### October 17, 2012 - CVE-2012-4520 [CVE-2012-4520](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4520&cid=2): `Host`協議頭污染。[Full description](https://www.djangoproject.com/weblog/2012/oct/17/security/) #### Versions affected * Django 1.3 [(patch)](https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071) * Django 1.4 [(patch)](https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3) ### December 10, 2012 - No CVE 1 對`Host`協議頭處理的額外加固。[Full description](https://www.djangoproject.com/weblog/2012/dec/10/security/) #### Versions affected * Django 1.3 [(patch)](https://github.com/django/django/commit/2da4ace0bc1bc1d79bf43b368cb857f6f0cd6b1b) * Django 1.4 [(patch)](https://github.com/django/django/commit/319627c184e71ae267d6b7f000e293168c7b6e09) ### December 10, 2012 - No CVE 2 對重定向驗證的額外加固。[Full description](https://www.djangoproject.com/weblog/2012/dec/10/security/) #### Versions affected * Django 1.3: [(patch)](https://github.com/django/django/commit/1515eb46daa0897ba5ad5f0a2db8969255f1b343) * Django 1.4: [(patch)](https://github.com/django/django/commit/b2ae0a63aeec741f1e51bac9a95a27fd635f9652) ### February 19, 2013 - No CVE 對`Host`協議頭處理的額外加固。[Full description](https://www.djangoproject.com/weblog/2013/feb/19/security/) #### Versions affected * Django 1.3 [(patch)](https://github.com/django/django/commit/27cd872e6e36a81d0bb6f5b8765a1705fecfc253) * Django 1.4 [(patch)](https://github.com/django/django/commit/9936fdb11d0bbf0bd242f259bfb97bbf849d16f8) ### February 19, 2013 - CVE-2013-1664/1665 [CVE-2013-1664](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1664&cid=2) and [CVE-2013-1665](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1665&cid=2): 對Python XML庫的基于實體的攻擊。[Full description](https://www.djangoproject.com/weblog/2013/feb/19/security/) #### Versions affected * Django 1.3 [(patch)](https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112) * Django 1.4 [(patch)](https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40) ### February 19, 2013 - CVE-2013-0305 [CVE-2013-0305](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0305&cid=2): 通過admin歷史記錄的信息泄露。[Full description](https://www.djangoproject.com/weblog/2013/feb/19/security/) #### Versions affected * Django 1.3 [(patch)](https://github.com/django/django/commit/d3a45e10c8ac8268899999129daa27652ec0da35) * Django 1.4 [(patch)](https://github.com/django/django/commit/0e7861aec73702f7933ce2a93056f7983939f0d6) ### February 19, 2013 - CVE-2013-0306 [CVE-2013-0306](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0306&cid=2): 通過表單集`max_num` 的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2013/feb/19/security/) #### Versions affected * Django 1.3 [(patch)](https://github.com/django/django/commit/d7094bbce8cb838f3b40f504f198c098ff1cf727) * Django 1.4 [(patch)](https://github.com/django/django/commit/0cc350a896f70ace18280410eb616a9197d862b0) ### August 13, 2013 - Awaiting CVE 1 (CVE not yet issued): 通過admin受信任的`URLField`值的XSS。[Full description](https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued/) #### Versions affected * Django 1.5 [(patch)](https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78) ### August 13, 2013 - Awaiting CVE 2 (CVE not yet issued):可能的XSS漏洞，通過未驗證的URL重定向模式。[Full description](https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a) * Django 1.5 [(patch)](https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f) ### September 10, 2013 - CVE-2013-4315 [CVE-2013-4315](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4315&cid=2) 通過`ssi`模板標簽的目錄遍歷。[Full description](https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/87d2750b39f6f2d54b7047225521a44dcd37e896) * Django 1.5 [(patch)](https://github.com/django/django/commit/988b61c550d798f9a66d17ee0511fb7a9a7f33ca) ### September 14, 2013 - CVE-2013-1443 CVE-2013-1443: 通過長密碼的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2013/sep/15/security/) #### Versions affected * Django 1.4 [(patch](https://github.com/django/django/commit/3f3d887a6844ec2db743fee64c9e53e04d39a368) and [Python compatibility fix)](https://github.com/django/django/commit/6903d1690a92aa040adfb0c8eb37cf62e4206714) * Django 1.5 [(patch)](https://github.com/django/django/commit/22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc) ### April 21, 2014 - CVE-2014-0472 [CVE-2014-0472](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0472&cid=2): 使用`reverse()`的非預期代碼執行。[Full description](https://www.djangoproject.com/weblog/2014/apr/21/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/c1a8c420fe4b27fb2caf5e46d23b5712fc0ac535) * Django 1.5 [(patch)](https://github.com/django/django/commit/2a5bcb69f42b84464b24b5c835dca6467b6aa7f1) * Django 1.6 [(patch)](https://github.com/django/django/commit/4352a50871e239ebcdf64eee6f0b88e714015c1b) * Django 1.7 [(patch)](https://github.com/django/django/commit/546740544d7f69254a67b06a3fc7fa0c43512958) ### April 21, 2014 - CVE-2014-0473 [CVE-2014-0473](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0473&cid=2): 匿名頁面的緩存可能會泄露CSRF標識。[Full description](https://www.djangoproject.com/weblog/2014/apr/21/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/1170f285ddd6a94a65f911a27788ba49ca08c0b0) * Django 1.5 [(patch)](https://github.com/django/django/commit/6872f42757d7ef6a97e0b6ec5db4d2615d8a2bd8) * Django 1.6 [(patch)](https://github.com/django/django/commit/d63e20942f3024f24cb8cd85a49461ba8a9b6736) * Django 1.7 [(patch)](https://github.com/django/django/commit/380545bf85cbf17fc698d136815b7691f8d023ca) ### April 21, 2014 - CVE-2014-0474 [CVE-2014-0474](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0474&cid=2): MySQL類型轉換產生非預期的查詢結果。[Full description](https://www.djangoproject.com/weblog/2014/apr/21/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/aa80f498de6d687e613860933ac58433ab71ea4b) * Django 1.5 [(patch)](https://github.com/django/django/commit/985434fb1d6bf2335bf96c6ebf91c3674f1f399f) * Django 1.6 [(patch)](https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292) * Django 1.7 [(patch)](https://github.com/django/django/commit/34526c2f56b863c2103655a0893ac801667e86ea) ### May 18, 2014 - CVE-2014-1418 [CVE-2014-1418](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1418&cid=2): 緩存可能允許存儲和處理私人數據。[Full description](https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/28e23306aa53bbbb8fb87db85f99d970b051026c) * Django 1.5 [(patch)](https://github.com/django/django/commit/4001ec8698f577b973c5a540801d8a0bbea1205b) * Django 1.6 [(patch)](https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769) * Django 1.7 [(patch)](https://github.com/django/django/commit/7fef18ba9e5a8b47bc24b5bb259c8bf3d3879f2a) ### May 18, 2014 - CVE-2014-3730 [CVE-2014-3730](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3730&cid=2): 來源于用戶輸入的錯誤格式URL的不正確驗證。[Full description](https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df) * Django 1.5 [(patch)](https://github.com/django/django/commit/ad32c218850ad40972dcef57beb460f8c979dd6d) * Django 1.6 [(patch)](https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3) * Django 1.7 [(patch)](https://github.com/django/django/commit/e7b0cace455c2da24492660636bfd48c45a19cdf) ### August 20, 2014 - CVE-2014-0480 [CVE-2014-0480](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0480&cid=2): reverse() 可能會生成指向其它域名的URL。[Full description](https://www.djangoproject.com/weblog/2014/aug/20/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/c2fe73133b62a1d9e8f7a6b43966570b14618d7e) * Django 1.5 [(patch)](https://github.com/django/django/commit/45ac9d4fb087d21902469fc22643f5201d41a0cd) * Django 1.6 [(patch)](https://github.com/django/django/commit/da051da8df5e69944745072611351d4cfc6435d5) * Django 1.7 [(patch)](https://github.com/django/django/commit/bf650a2ee78c6d1f4544a875dcc777cf27fe93e9) ### August 20, 2014 - CVE-2014-0481 [CVE-2014-0481](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0481&cid=2): 文件上傳的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2014/aug/20/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/30042d475bf084c6723c6217a21598d9247a9c41) * Django 1.5 [(patch)](https://github.com/django/django/commit/26cd48e166ac4d84317c8ee6d63ac52a87e8da99) * Django 1.6 [(patch)](https://github.com/django/django/commit/dd0c3f4ee1a30c1a1e6055061c6ba6e58c6b54d1) * Django 1.7 [(patch)](https://github.com/django/django/commit/3123f8452cf49071be9110e277eea60ba0032216) ### August 20, 2014 - CVE-2014-0482 [CVE-2014-0482](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0482&cid=2): RemoteUserMiddleware會話劫持。[Full description](https://www.djangoproject.com/weblog/2014/aug/20/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/c9e3b9949cd55f090591fbdc4a114fcb8368b6d9) * Django 1.5 [(patch)](https://github.com/django/django/commit/dd68f319b365f6cb38c5a6c106faf4f6142d7d88) * Django 1.6 [(patch)](https://github.com/django/django/commit/0268b855f9eab3377f2821164ef3e66037789e09) * Django 1.7 [(patch)](https://github.com/django/django/commit/1a45d059c70385fcd6f4a3955f3b4e4cc96d0150) ### August 20, 2014 - CVE-2014-0483 [CVE-2014-0483](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0483&cid=2): admin中查詢集操作產生的數據泄露。[Full description](https://www.djangoproject.com/weblog/2014/aug/20/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/027bd348642007617518379f8b02546abacaa6e0) * Django 1.5 [(patch)](https://github.com/django/django/commit/2a446c896e7c814661fb9c4f212b071b2a7fa446) * Django 1.6 [(patch)](https://github.com/django/django/commit/f7c494f2506250b8cb5923714360a3642ed63e0f) * Django 1.7 [(patch)](https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6) ### January 13, 2015 - CVE-2015-0219 [CVE-2015-0219](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0219&cid=2): 通過下劃線或者破折號合并產生的WSGI協議頭欺騙。[Full description](https://www.djangoproject.com/weblog/2015/jan/13/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/4f6fffc1dc429f1ad428ecf8e6620739e8837450) * Django 1.6 [(patch)](https://github.com/django/django/commit/d7597b31d5c03106eeba4be14a33b32a5e25f4ee) * Django 1.7 [(patch)](https://github.com/django/django/commit/41b4bc73ee0da7b2e09f4af47fc1fd21144c710f) ### January 13, 2015 - CVE-2015-0220 [CVE-2015-0220](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0220&cid=2):  通過用戶提供的重定向URL的可能的XSS攻擊。[Full description](https://www.djangoproject.com/weblog/2015/jan/13/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/4c241f1b710da6419d9dca160e80b23b82db7758) * Django 1.6 [(patch)](https://github.com/django/django/commit/72e0b033662faa11bb7f516f18a132728aa0ae28) * Django 1.7 [(patch)](https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89) ### January 13, 2015 - CVE-2015-0221 [CVE-2015-0221](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0221&cid=2): `django.views.static.serve()`上的拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2015/jan/13/security/) #### Versions affected * Django 1.4 [(patch)](https://github.com/django/django/commit/d020da6646c5142bc092247d218a3d1ce3e993f7) * Django 1.6 [(patch)](https://github.com/django/django/commit/553779c4055e8742cc832ed525b9ee34b174934f) * Django 1.7 [(patch)](https://github.com/django/django/commit/818e59a3f0fbadf6c447754d202d88df025f8f2a) ### January 13, 2015 - CVE-2015-0222 [CVE-2015-0222](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0222&cid=2): 使用`ModelMultipleChoiceField`的數據庫拒絕服務攻擊。[Full description](https://www.djangoproject.com/weblog/2015/jan/13/security/) #### Versions affected * Django 1.6 [(patch)](https://github.com/django/django/commit/d7a06ee7e571b6dad07c0f5b519b1db02e2a476c) * Django 1.7 [(patch)](https://github.com/django/django/commit/bcfb47780ce7caecb409a9e9c1c314266e41d392) > 譯者：[Django 文檔協作翻譯小組](http://python.usyiyi.cn/django/index.html)，原文：[Disclosed security issues in Django](https://docs.djangoproject.com/en/1.8/releases/security/)。 > > 本文以 [CC BY-NC-SA 3.0](http://creativecommons.org/licenses/by-nc-sa/3.0/cn/) 協議發布，轉載請保留作者署名和文章出處。 > > [Django 文檔協作翻譯小組](http://python.usyiyi.cn/django/index.html)人手緊缺，有興趣的朋友可以加入我們，完全公益性質。交流群：467338606。