May 6, 2021
Django 3.2.2 fixes a security issue and a bug in 3.2.1.
URLValidatoraccepted newlines in input on Python 3.9.5+¶
On Python 3.9.5+,
URLValidator didn’t prohibit
newlines and tabs. If you used values with newlines in HTTP response, you could
suffer from header injection attacks. Django itself wasn’t vulnerable because
HttpResponse prohibits newlines in HTTP headers.
URLField form field which uses
removes newlines and tabs on Python 3.9.5+, so the possibility of newlines
entering your data only existed if you are using this validator outside of the
This issue was introduced by the bpo-43882 fix.
Prevented, following a regression in Django 3.2.1,
from generating infinite migrations for a model with
OrderBy expressions (#32714).