mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-26 20:10:35 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/python-django: security bump to v5.2.12

Browse Source 
See the release notes:
https://docs.djangoproject.com/en/5.2/releases/5.2.12/

This fixes the following vulnerabilities:

- CVE-2026-25673:
    An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and
    4.2 before 4.2.29. `URLField.to_python()` in Django calls
    `urllib.parse.urlsplit()`, which performs NFKC normalization on
    Windows that is disproportionately slow for certain Unicode
    characters, allowing a remote attacker to cause denial of service via
    large URL inputs containing these characters. Earlier, unsupported
    Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and
    may also be affected. Django would like to thank Seokchan Yoon for
    reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-25673

- CVE-2026-25674:
    An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and
    4.2 before 4.2.29. Race condition in file-system storage and file-
    based cache backends in Django allows an attacker to cause file system
    objects to be created with incorrect permissions via concurrent
    requests, where one thread's temporary `umask` change affects other
    threads in multi-threaded environments. Earlier, unsupported Django
    series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may
    also be affected. Django would like to thank Tarek Nakkouch for
    reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-25674

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit c8dd9e9a01)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-03-30 11:06:48 +02:00
committed by Thomas Perale
parent 6b208dd1d2
commit 36bf173d21
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/python-django/python-django.hash
View File

@@ -1,6 +1,6 @@
# md5, sha256 from https://pypi.org/pypi/django/json
md5 051357d45eb71a115a64e6d2a79c7c51 django-5.2.11.tar.gz
sha256 7f2d292ad8b9ee35e405d965fbbad293758b858c34bbf7f3df551aeeac6f02d3 django-5.2.11.tar.gz
md5 9b60bb1145abcc97d276694f3f82a3b8 django-5.2.12.tar.gz
sha256 6b809af7165c73eff5ce1c87fdae75d4da6520d6667f86401ecf55b681eb1eeb django-5.2.12.tar.gz
# Locally computed sha256 checksums
sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE
sha256 dcac1c86cb7ab491702bdb4c41be680fafde51536748cc8aaee3840eec53ed17 django/contrib/gis/measure.py

4
package/python-django/python-django.mk
View File

@@ -4,10 +4,10 @@
#
################################################################################
PYTHON_DJANGO_VERSION = 5.2.11
PYTHON_DJANGO_VERSION = 5.2.12
PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz
# The official Django site has an unpractical URL
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/17/f2/3e57ef696b95067e05ae206171e47a8e53b9c84eec56198671ef9eaa51a6
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/bd/55/b9445fc0695b03746f355c05b2eecc54c34e05198c686f4fc4406b722b52
PYTHON_DJANGO_LICENSE = BSD-3-Clause, MIT (jquery, utils/archive.py), BSD-2-Clause (inlines.js)
PYTHON_DJANGO_LICENSE_FILES = LICENSE \
django/contrib/gis/measure.py \