mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-02 05:33:57 -09:00
4fe009b6aa
Django 6.0.5 fixes three security issues with severity “low” and several bugs in 6.0.4.
Security Fixes:
* CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
requests via file upload limit bypass ASGI requests with a missing
or understated Content-Length header could bypass the
FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
memory and causing service degradation.
As a reminder, Django expects a limit to be configured at the web server
level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.
This issue has severity “low” according to the Django security policy
* CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Response headers did not vary on cookies if a session was not modified,
but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a
user’s session after that user visits a cached public page.
This issue has severity “low” according to the Django security policy.
* CVE-2026-6907: Potential exposure of private data due to incorrect
handling of Vary: * in UpdateCacheMiddleware
Previously, UpdateCacheMiddleware would erroneously cache requests where
the Vary header contained an asterisk ('*'). This could lead to private
data being stored and served.
This issue has severity “low” according to the Django security policy.
Bugfixes:
* Fixed a misplaced </div> in the
django/contrib/admin/templates/admin/change_list.html template added
in Django 6.0 that could be problematic when overriding the pagination
block (#37029).
* Fixed a bug in Django 6.0 where deprecation warnings incorrectly
skipped lines from third-party packages prefixed with “django”
(#37067).
Release notes: https://docs.djangoproject.com/en/6.0/releases/6.0.5/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
27 lines
1.1 KiB
Makefile
27 lines
1.1 KiB
Makefile
################################################################################
|
|
#
|
|
# python-django
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_DJANGO_VERSION = 6.0.5
|
|
PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz
|
|
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/source/d/django
|
|
PYTHON_DJANGO_LICENSE = BSD-3-Clause, MIT (jquery, utils/archive.py), BSD-2-Clause (inlines.js), CC-BY-4.0 (admin svg files)
|
|
PYTHON_DJANGO_LICENSE_FILES = LICENSE \
|
|
django/contrib/gis/measure.py \
|
|
django/contrib/gis/gdal/LICENSE \
|
|
django/contrib/gis/geos/LICENSE \
|
|
django/contrib/admin/static/admin/js/inlines.js \
|
|
django/contrib/admin/static/admin/js/vendor/jquery/LICENSE.txt \
|
|
django/contrib/admin/static/admin/js/vendor/select2/LICENSE.md \
|
|
django/contrib/admin/static/admin/js/vendor/xregexp/LICENSE.txt \
|
|
django/contrib/admin/static/admin/img/README.md \
|
|
django/dispatch/license.txt \
|
|
django/utils/archive.py
|
|
PYTHON_DJANGO_CPE_ID_VENDOR = djangoproject
|
|
PYTHON_DJANGO_CPE_ID_PRODUCT = django
|
|
PYTHON_DJANGO_SETUP_TYPE = setuptools
|
|
|
|
$(eval $(python-package))
|