mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-26 20:10:35 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/python-django: security bump to v5.2.15

Browse Source 
See the release notes:
- https://docs.djangoproject.com/en/5.2/releases/5.2.14/
- https://docs.djangoproject.com/en/5.2/releases/5.2.15/

This fixes the following vulnerabilities:
- CVE-2026-5766 : Potential denial-of-service vulnerability in ASGI requests
                  via file upload limit bypass
- CVE-2026-35192: Session fixation via public cached pages and
                  SESSION_SAVE_EVERY_REQUEST
- CVE-2026-6907 : Potential exposure of private data due to incorrect handling
                  of Vary: * in UpdateCacheMiddleware
- CVE-2026-6873 : Signed cookie salt namespace collision
- CVE-2026-7666 : Potential unencrypted email transmission via STARTTLS
                  in the SMTP backend
- CVE-2026-8404 : Potential exposure of private data via case-sensitive
                  Cache-Control directives
- CVE-2026-35193: Potential exposure of private data via missing
                  Vary: Authorization
- CVE-2026-48587: Potential exposure of private data via whitespace padding
                  in Vary header

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 00b9069f46)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-06-12 11:07:52 +02:00
committed by Thomas Perale
parent bb975551e6
commit 24e0c552a4
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/python-django/python-django.hash
View File

@@ -1,6 +1,6 @@
# md5, sha256 from https://pypi.org/pypi/django/json
md5 4af55cc09a3d1a828259ad0c05330e6b django-5.2.13.tar.gz
sha256 a31589db5188d074c63f0945c3888fad104627dfcc236fb2b97f71f89da33bc4 django-5.2.13.tar.gz
md5 9db6f4aaaf130e3f53a4c5255c1b1bcd django-5.2.15.tar.gz
sha256 5154a9bf84ac01dde011e367f355c07dbb329532e06810dcf3ef2af269e236e7 django-5.2.15.tar.gz
# Locally computed sha256 checksums
sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE
sha256 a6fa72074c31928128aaa18162204507938b7a9a8b819bd833fa82467441800d django/contrib/gis/measure.py

2
package/python-django/python-django.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
PYTHON_DJANGO_VERSION = 5.2.13
PYTHON_DJANGO_VERSION = 5.2.15
PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz
# The official Django site has an unpractical URL
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/source/d/django