From beba0e7a7852f5d5bce58ff4011be745e8aa9271 Mon Sep 17 00:00:00 2001 From: Marcus Hoffmann Date: Thu, 12 Feb 2026 11:42:32 +0100 Subject: [PATCH] package/python-asgiref: security bump to 3.11.1 Fixes CVE-2025-14550: There was a potential DoS vector for users of the ``asgiref.wsgi.WsgiToAsgi`` adapter. Malicious requests, including an unreasonably large number of values for the same header, could lead to resource exhaustion when building the WSGI environment. Changelog: https://github.com/django/asgiref/blob/3.11.1/CHANGELOG.txt Signed-off-by: Marcus Hoffmann Signed-off-by: Julien Olivain --- package/python-asgiref/python-asgiref.hash | 4 ++-- package/python-asgiref/python-asgiref.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python-asgiref/python-asgiref.hash b/package/python-asgiref/python-asgiref.hash index 89495e0257..aecbdf8000 100644 --- a/package/python-asgiref/python-asgiref.hash +++ b/package/python-asgiref/python-asgiref.hash @@ -1,5 +1,5 @@ # md5, sha256 from https://pypi.org/pypi/asgiref/json -md5 554794453502d266a90d2254fcb1f7c3 asgiref-3.11.0.tar.gz -sha256 13acff32519542a1736223fb79a715acdebe24286d98e8b164a73085f40da2c4 asgiref-3.11.0.tar.gz +md5 85bc32494d842f4941e2b1fc2c7b61cb asgiref-3.11.1.tar.gz +sha256 5f184dc43b7e763efe848065441eac62229c9f7b0475f41f80e207a114eda4ce asgiref-3.11.1.tar.gz # Locally computed sha256 checksums sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE diff --git a/package/python-asgiref/python-asgiref.mk b/package/python-asgiref/python-asgiref.mk index e5885a66c6..392f0a1c1e 100644 --- a/package/python-asgiref/python-asgiref.mk +++ b/package/python-asgiref/python-asgiref.mk @@ -4,9 +4,9 @@ # ################################################################################ -PYTHON_ASGIREF_VERSION = 3.11.0 +PYTHON_ASGIREF_VERSION = 3.11.1 PYTHON_ASGIREF_SOURCE = asgiref-$(PYTHON_ASGIREF_VERSION).tar.gz -PYTHON_ASGIREF_SITE = https://files.pythonhosted.org/packages/76/b9/4db2509eabd14b4a8c71d1b24c8d5734c52b8560a7b1e1a8b56c8d25568b +PYTHON_ASGIREF_SITE = https://files.pythonhosted.org/packages/63/40/f03da1264ae8f7cfdbf9146542e5e7e8100a4c66ab48e791df9a03d3f6c0 PYTHON_ASGIREF_SETUP_TYPE = setuptools PYTHON_ASGIREF_LICENSE = BSD-3-Clause PYTHON_ASGIREF_LICENSE_FILES = LICENSE