From a0b458582fa7a20bc17e76d911c0337503b63847 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Thu, 12 Jun 2025 22:44:20 +0200 Subject: [PATCH] package/python-django: security bump to 5.1.11 Fixes the following security issue: - CVE-2025-48432: Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-48432 For more details on the version bump, see the release notes: - https://docs.djangoproject.com/en/5.1/releases/5.1.11/ Signed-off-by: Thomas Perale --- package/python-django/python-django.hash | 4 ++-- package/python-django/python-django.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python-django/python-django.hash b/package/python-django/python-django.hash index ff3f8105d8..f307c61b0d 100644 --- a/package/python-django/python-django.hash +++ b/package/python-django/python-django.hash @@ -1,6 +1,6 @@ # md5, sha256 from https://pypi.org/pypi/django/json -md5 d3b7a04b581dec5d74769df44e0ddbd1 django-5.1.10.tar.gz -sha256 73e5d191421d177803dbd5495d94bc7d06d156df9561f4eea9e11b4994c07137 django-5.1.10.tar.gz +md5 054d6f2ad897359de8378c190d73121e django-5.1.11.tar.gz +sha256 3bcdbd40e4d4623b5e04f59c28834323f3086df583058e65ebce99f9982385ce django-5.1.11.tar.gz # Locally computed sha256 checksums sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE sha256 dcac1c86cb7ab491702bdb4c41be680fafde51536748cc8aaee3840eec53ed17 django/contrib/gis/measure.py diff --git a/package/python-django/python-django.mk b/package/python-django/python-django.mk index 8fa2a474e2..94cc2a86ce 100644 --- a/package/python-django/python-django.mk +++ b/package/python-django/python-django.mk @@ -4,10 +4,10 @@ # ################################################################################ -PYTHON_DJANGO_VERSION = 5.1.10 +PYTHON_DJANGO_VERSION = 5.1.11 PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz # The official Django site has an unpractical URL -PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/73/ca/1c724be89e603eb8b5587ea24c63a8c30094c8ff4d990780b5033ee15c40 +PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/83/80/bf0f9b0aa434fca2b46fc6a31c39b08ea714b87a0a72a16566f053fb05a8 PYTHON_DJANGO_LICENSE = BSD-3-Clause, MIT (jquery, utils/archive.py), BSD-2-Clause (inlines.js) PYTHON_DJANGO_LICENSE_FILES = LICENSE \ django/contrib/gis/measure.py \