Django SQL×¢Èë·ì϶·çÏÕ¹«¸æ

°ä²¼¹¦·ò 2020-02-13

·ì϶±àºÅºÍ¼¶±ð


CVE±àºÅ£ºCVE-2020-7471£¬£¬£¬£¬£¬£¬£¬£¬Î£ÏÕ¼¶±ð£ºÑϳÁ£¬£¬£¬£¬£¬£¬£¬£¬CVSS·ÖÖµ£º9.8


Ó°Ïì°æ±¾


Django 1.11.x < 1.11.28

Django 2.2.x < 2.2.10

Django 3.0.x < 3.0.3

Django Ö÷¿ª·¢·ÖÖ§


·ì϶¸ÅÊö


DjangoÊÇDjango»ù½ð»áµÄÒ»Ì×»ùÓÚPython˵»°µÄ¿ªÔ´WebÀûÓÿò¼Ü¡£¡£¡£¡£¡£¡£¡£¸Ã¿ò¼ÜÔ̺¬ÃæÏò¶ÔÏóµÄÓ³ÉäÆ÷¡¢ÊÓͼϵͳ¡¢Ä£°åϵͳµÈ¡£¡£¡£¡£¡£¡£¡£


½üÈÕ£¬£¬£¬£¬£¬£¬£¬£¬Django¹Ù·½°ä²¼°²È«¹«¸æ°ä²¼ÁËÒ»¸öͨ¹ýStringAgg£¨·Ö¸ô·û£©ÊµÏÖÀûÓõÄDZÔÚSQL×¢Èë·ì϶¡£¡£¡£¡£¡£¡£¡£¹¥»÷Õß¿Éͨ¹ý»ú¹Ø·Ö¸ô·û´«µÝ¸ø¾ÛºÏº¯Êýcontrib.postgres.aggregates.StringAgg£¬£¬£¬£¬£¬£¬£¬£¬´Ó¶øÈƹýתÒå²¢×¢Èë¶ñÒâSQLÓï¾ä¡£¡£¡£¡£¡£¡£¡£


ÓйØÓû§¿Éͨ¹ý°æ±¾¼ì²âµÄ²½ÖèÅжϵ±Ç°ÀûÓÃÊÇ·ñ´æÔÚ·çÏÕ¡£¡£¡£¡£¡£¡£¡£ÔÚºÅÁîÐÐÊäÈë python¡£¡£¡£¡£¡£¡£¡£¶øºóÔÚ Python ÌáÐÑ·ûÏÂÊäÈëÏÂÁкÅÁ£¬£¬£¬£¬£¬£¬£¬¿É²é¿´µ±Ç°Django°æ±¾ÐÅÏ¢¡£¡£¡£¡£¡£¡£¡£ÈôDjango°æ±¾ÔÚÊÜÓ°ÏìÁìÓòÄÚ£¬£¬£¬£¬£¬£¬£¬£¬ÇÒʹÓõÄÊý¾Ý¿âΪPostgreSQL£¬£¬£¬£¬£¬£¬£¬£¬Ôò´æÔÚ´Ë·ì϶µÄ°²È«·çÏÕ¡£¡£¡£¡£¡£¡£¡£


>>> import django

>>> django.get_version()


»òÕߣ¬£¬£¬£¬£¬£¬£¬£¬´Ë·ì϶ÊÇÓÉÓھۺϺ¯ÊýStringAggµ¼Ö£¬£¬£¬£¬£¬£¬£¬£¬ÈôDjango°æ±¾ÔÚÊÜÓ°ÏìÁìÓòÄÚ£¬£¬£¬£¬£¬£¬£¬£¬ÇÒʹÓÃÁ˸þۺϺ¯Êý£¬£¬£¬£¬£¬£¬£¬£¬Ôò¿ÉÄÜ´æÔÚ°²È«·çÏÕ¡£¡£¡£¡£¡£¡£¡£¿£¿£¿ £¿£¿£¿ £¿ª·¢ÈËÔ±¿É×ÔÐÐÅŲéÊÇ·ñʹÓÃÁËÏÂÁк¯Êý¡£¡£¡£¡£¡£¡£¡£StringAggº¯Êý£¬£¬£¬£¬£¬£¬£¬£¬ÊÇPostgreSQLÊý¾Ý¿âÖн«±í°×ʽÔì³É×Ö·û´®µÄ¾ÛºÏº¯Êý£¬£¬£¬£¬£¬£¬£¬£¬¿ÉʵÏÖ¶àÐÐÆ´½Ó£¬£¬£¬£¬£¬£¬£¬£¬ÀûÓÃ¿í·º¡£¡£¡£¡£¡£¡£¡£


django.contrib.postgres.aggregates.StringAgg¡£¡£¡£¡£¡£¡£¡£


·ì϶ÑéÖ¤


ÔÝÎÞPOC/EXP¡£¡£¡£¡£¡£¡£¡£


½¨¸´½¨Òé


Django ¹Ù·½ÒѾ­°ä²¼Ð°汾½¨¸´ÁËÉÏÊö·ì϶£¬£¬£¬£¬£¬£¬£¬£¬ÇëÊÜÓ°ÏìµÄÓû§¾¡¿ìÉý¼¶½øÐзÀ»¤¡£¡£¡£¡£¡£¡£¡£


Django 1.11.28ÏÂÔØµØÖ·£ºhttps://www.djangoproject.com/m/releases/1.11/Django-1.11.28.tar.gz

Django 2.2.10 ÏÂÔØµØÖ·£ºhttps://www.djangoproject.com/m/releases/2.2/Django-2.2.10.tar.gz

Django 3.0.3ÏÂÔØµØÖ·£ºhttps://www.djangoproject.com/m/releases/3.0/Django-3.0.3.tar.gz


ÈôʹÓà pip ×°Öà Django£¬£¬£¬£¬£¬£¬£¬£¬¿Éͨ¹ý --upgrade »ò -U À´ÊµÏִ˲Ù×÷£º


$ pip install -U Django


°æ±¾¸üвÙ×÷¿É²Î¿¼ÏÂÁÐÁ´½Ó£º


https://docs.djangoproject.com/zh-hans/2.2/howto/upgrade-version


²Î¿¼Á´½Ó


https://www.djangoproject.com/weblog/2020/feb/03/security-releases