Django - 3.1.13


Django 3.1.13 release notes

July 1, 2021

Django 3.1.13 fixes a security issue with severity “high” in 3.1.12.

CVE-2021-35042: Potential SQL injection via unsanitized QuerySet.order\_by() input

Unsanitized user input passed to QuerySet.order\_by() could bypass intended
column reference validation in path marked for deprecation resulting in a
potential SQL injection even if a deprecation warning is emitted.

As a mitigation the strict column reference validation was restored for the
duration of the deprecation period. This regression appeared in 3.1 as a side
effect of fixing #31426.

The issue is not present in the main branch as the deprecated path has been


July 1, 2021, 6:37 a.m.
Register or login to:
  • 🔍View and search all Django releases.
  • 🛠️Create and share lists to track your tools.
  • 🚨Setup notifications for major, security, feature or patch updates.
  • 🚀Much more coming soon!
Continue with GitHub
Continue with Google