mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 08:30:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/python-django: security bump to v5.2.11

Browse Source 
See the release notes:
https://docs.djangoproject.com/en/5.2/releases/5.2.11/

This is a security release on Django's LTS branch,
fixing the following vulnerabilties:

- CVE-2025-13473:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. The
    `django.contrib.auth.handlers.modwsgi.check_password()` function for
    authentication via `mod_wsgi` allows remote attackers to enumerate
    users via a timing attack. Earlier, unsupported Django series (such as
    5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
    Django would like to thank Stackered for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2025-13473

- CVE-2025-14550:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a
    potential denial-of-service via a crafted request with multiple
    duplicate headers. Earlier, unsupported Django series (such as 5.0.x,
    4.1.x, and 3.2.x) were not evaluated and may also be affected. Django
    would like to thank Jiyong Yang for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2025-14550

- CVE-2026-1207:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented
    on PostGIS) allows remote attackers to inject SQL via the band index
    parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x,
    and 3.2.x) were not evaluated and may also be affected. Django would
    like to thank Tarek Nakkouch for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-1207

- CVE-2026-1285:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and
    `Truncator.words()` methods (with `html=True`) and the
    `truncatechars_html` and `truncatewords_html` template filters allow a
    remote attacker to cause a potential denial-of-service via crafted
    inputs containing a large number of unmatched HTML end tags. Earlier,
    unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not
    evaluated and may also be affected. Django would like to thank
    Seokchan Yoon for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-1285

- CVE-2026-1287:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in
    column aliases via control characters, using a suitably crafted
    dictionary, with dictionary expansion, as the `**kwargs` passed to
    `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`,
    `values_list()`, and `alias()`. Earlier, unsupported Django series
    (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be
    affected. Django would like to thank Solomon Kebede for reporting this
    issue.
    https://www.cve.org/CVERecord?id=CVE-2026-1287

- CVE-2026-1312:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection
    in column aliases containing periods when the same alias is, using a
    suitably crafted dictionary, with dictionary expansion, used in
    `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x,
    4.1.x, and 3.2.x) were not evaluated and may also be affected. Django
    would like to thank Solomon Kebede for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-1312

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[thomas: update hash for inlines.js]
(cherry picked from commit f8e89786f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-02-16 18:12:20 +01:00
committed by Thomas Perale
parent d393c0feb4
commit 3a5bb6080b
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/python-django/python-django.hash
View File

@@ -1,6 +1,6 @@
# md5, sha256 from https://pypi.org/pypi/django/json
md5 e7d89ddfdca79542039dbab31e4bede8 django-5.2.9.tar.gz
sha256 16b5ccfc5e8c27e6c0561af551d2ea32852d7352c67d452ae3e76b4f6b2ca495 django-5.2.9.tar.gz
md5 051357d45eb71a115a64e6d2a79c7c51 django-5.2.11.tar.gz
sha256 7f2d292ad8b9ee35e405d965fbbad293758b858c34bbf7f3df551aeeac6f02d3 django-5.2.11.tar.gz
# Locally computed sha256 checksums
sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE
sha256 dcac1c86cb7ab491702bdb4c41be680fafde51536748cc8aaee3840eec53ed17 django/contrib/gis/measure.py

4
package/python-django/python-django.mk
View File

@@ -4,10 +4,10 @@
#
################################################################################
PYTHON_DJANGO_VERSION = 5.2.9
PYTHON_DJANGO_VERSION = 5.2.11
PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz
# The official Django site has an unpractical URL
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/eb/1c/188ce85ee380f714b704283013434976df8d3a2df8e735221a02605b6794
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/17/f2/3e57ef696b95067e05ae206171e47a8e53b9c84eec56198671ef9eaa51a6
PYTHON_DJANGO_LICENSE = BSD-3-Clause, MIT (jquery, utils/archive.py), BSD-2-Clause (inlines.js)
PYTHON_DJANGO_LICENSE_FILES = LICENSE \
django/contrib/gis/measure.py \