From 599ce8869357de58a92865caa541b90a94df5994 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Thu, 11 Sep 2025 18:23:03 +0200 Subject: [PATCH] package/python-django: security bump to v5.1.12 See the release notes: - https://docs.djangoproject.com/en/5.1/releases/5.1.12/ This fixes the following vulnerability: - CVE-2025-57833: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias(). https://www.cve.org/CVERecord?id=CVE-2025-57833 Signed-off-by: Titouan Christophe Signed-off-by: Thomas Perale --- package/python-django/python-django.hash | 4 ++-- package/python-django/python-django.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python-django/python-django.hash b/package/python-django/python-django.hash index f307c61b0d..155e3af8ef 100644 --- a/package/python-django/python-django.hash +++ b/package/python-django/python-django.hash @@ -1,6 +1,6 @@ # md5, sha256 from https://pypi.org/pypi/django/json -md5 054d6f2ad897359de8378c190d73121e django-5.1.11.tar.gz -sha256 3bcdbd40e4d4623b5e04f59c28834323f3086df583058e65ebce99f9982385ce django-5.1.11.tar.gz +md5 7f7a03e4f19ad7813d96f9fbbad65a5c django-5.1.12.tar.gz +sha256 8a8991b1ec052ef6a44fefd1ef336ab8daa221287bcb91a4a17d5e1abec5bbcc django-5.1.12.tar.gz # Locally computed sha256 checksums sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE sha256 dcac1c86cb7ab491702bdb4c41be680fafde51536748cc8aaee3840eec53ed17 django/contrib/gis/measure.py diff --git a/package/python-django/python-django.mk b/package/python-django/python-django.mk index 94cc2a86ce..3026c304be 100644 --- a/package/python-django/python-django.mk +++ b/package/python-django/python-django.mk @@ -4,10 +4,10 @@ # ################################################################################ -PYTHON_DJANGO_VERSION = 5.1.11 +PYTHON_DJANGO_VERSION = 5.1.12 PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz # The official Django site has an unpractical URL -PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/83/80/bf0f9b0aa434fca2b46fc6a31c39b08ea714b87a0a72a16566f053fb05a8 +PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/f0/99/a951d93a27a5bc59fb96edbcdbc03fb9bfac51177f1bc0110888de85af3f PYTHON_DJANGO_LICENSE = BSD-3-Clause, MIT (jquery, utils/archive.py), BSD-2-Clause (inlines.js) PYTHON_DJANGO_LICENSE_FILES = LICENSE \ django/contrib/gis/measure.py \