mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-02 13:43:52 -09:00
742c874f67
Django 6.0.5 fixes three security issues with severity “low” and several bugs in 6.0.4.
Security Fixes:
* CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
requests via file upload limit bypass ASGI requests with a missing
or understated Content-Length header could bypass the
FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
memory and causing service degradation.
As a reminder, Django expects a limit to be configured at the web server
level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.
This issue has severity “low” according to the Django security policy
* CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Response headers did not vary on cookies if a session was not modified,
but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a
user’s session after that user visits a cached public page.
This issue has severity “low” according to the Django security policy.
* CVE-2026-6907: Potential exposure of private data due to incorrect
handling of Vary: * in UpdateCacheMiddleware
Previously, UpdateCacheMiddleware would erroneously cache requests where
the Vary header contained an asterisk ('*'). This could lead to private
data being stored and served.
This issue has severity “low” according to the Django security policy.
Bugfixes:
* Fixed a misplaced </div> in the
django/contrib/admin/templates/admin/change_list.html template added
in Django 6.0 that could be problematic when overriding the pagination
block (#37029).
* Fixed a bug in Django 6.0 where deprecation warnings incorrectly
skipped lines from third-party packages prefixed with “django”
(#37067).
Release notes: https://docs.djangoproject.com/en/6.0/releases/6.0.5/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4fe009b6aa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
16 lines
1.5 KiB
Plaintext
16 lines
1.5 KiB
Plaintext
# md5, sha256 from https://pypi.org/pypi/django/json
|
|
md5 44c18a8f264c1326e6fe4f1053fea5fc django-6.0.5.tar.gz
|
|
sha256 bc6d6872e98a2864c836e42edd644b362db311147dd5aa8d5b82ba7a032f5269 django-6.0.5.tar.gz
|
|
# Locally computed sha256 checksums
|
|
sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE
|
|
sha256 be30dc0e3f7010af6c453d205feaece1f89494789b6e92f0c255ef597a1e6864 django/contrib/gis/measure.py
|
|
sha256 570a045a8372b6cd6a00e30ebafe8e3e8dfc0a7fe3d4ef2cc5f16d419eb63aeb django/contrib/gis/gdal/LICENSE
|
|
sha256 08bf24b7551238ae325295245425b1caeb9ad0f42f9e2d303c7b353502632045 django/contrib/gis/geos/LICENSE
|
|
sha256 d48633adb736dac091477ec2206feebeee88e3e6e486aedb21c584e4b49be0ec django/contrib/admin/static/admin/js/inlines.js
|
|
sha256 d4db9ebe6f29f5168eac45ad713f055623ac5d0dcd5ba92da23d650ae012020d django/contrib/admin/static/admin/js/vendor/jquery/LICENSE.txt
|
|
sha256 4ee0cbc51370afde358652a0f977972053729ed578b6a42f5e2a037d114f0b39 django/contrib/admin/static/admin/js/vendor/select2/LICENSE.md
|
|
sha256 73af2949bff9296cb0f816c3be19a4da4e95adc94c1f924796e8bad3f03f2f29 django/contrib/admin/static/admin/js/vendor/xregexp/LICENSE.txt
|
|
sha256 6e3bedbbf4310061e026d1b0b99beb390b845bfd29732455c13dd320db1feca6 django/contrib/admin/static/admin/img/README.md
|
|
sha256 54004c4b606964ebc163af16d04607c16e428f8a78a026fecb53f70c09f4a94f django/dispatch/license.txt
|
|
sha256 d1046875a3eff7419a4e55b254fbb68fd58dfdbc701626bc8f57da76a5120cc4 django/utils/archive.py
|