From 24e0c552a4ad1b1dad26731d67636934bb97f233 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Fri, 12 Jun 2026 11:07:52 +0200 Subject: [PATCH] package/python-django: security bump to v5.2.15 See the release notes: - https://docs.djangoproject.com/en/5.2/releases/5.2.14/ - https://docs.djangoproject.com/en/5.2/releases/5.2.15/ This fixes the following vulnerabilities: - CVE-2026-5766 : Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass - CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST - CVE-2026-6907 : Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware - CVE-2026-6873 : Signed cookie salt namespace collision - CVE-2026-7666 : Potential unencrypted email transmission via STARTTLS in the SMTP backend - CVE-2026-8404 : Potential exposure of private data via case-sensitive Cache-Control directives - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header Signed-off-by: Titouan Christophe (cherry picked from commit 00b9069f461075acdf49996b7ecd7c9175dc4ec3) Signed-off-by: Thomas Perale --- package/python-django/python-django.hash | 4 ++-- package/python-django/python-django.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/python-django/python-django.hash b/package/python-django/python-django.hash index a7bf2aed8b..8121d67796 100644 --- a/package/python-django/python-django.hash +++ b/package/python-django/python-django.hash @@ -1,6 +1,6 @@ # md5, sha256 from https://pypi.org/pypi/django/json -md5 4af55cc09a3d1a828259ad0c05330e6b django-5.2.13.tar.gz -sha256 a31589db5188d074c63f0945c3888fad104627dfcc236fb2b97f71f89da33bc4 django-5.2.13.tar.gz +md5 9db6f4aaaf130e3f53a4c5255c1b1bcd django-5.2.15.tar.gz +sha256 5154a9bf84ac01dde011e367f355c07dbb329532e06810dcf3ef2af269e236e7 django-5.2.15.tar.gz # Locally computed sha256 checksums sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE sha256 a6fa72074c31928128aaa18162204507938b7a9a8b819bd833fa82467441800d django/contrib/gis/measure.py diff --git a/package/python-django/python-django.mk b/package/python-django/python-django.mk index a478c95f95..cae4542099 100644 --- a/package/python-django/python-django.mk +++ b/package/python-django/python-django.mk @@ -4,7 +4,7 @@ # ################################################################################ -PYTHON_DJANGO_VERSION = 5.2.13 +PYTHON_DJANGO_VERSION = 5.2.15 PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz # The official Django site has an unpractical URL PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/source/d/django