mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-09 17:03:35 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/python-django: security bump to v5.2.11

Browse Source 
See the release notes:
https://docs.djangoproject.com/en/5.2/releases/5.2.11/

This is a security release on Django's LTS branch,
fixing the following vulnerabilties:

- CVE-2025-13473:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. The
    `django.contrib.auth.handlers.modwsgi.check_password()` function for
    authentication via `mod_wsgi` allows remote attackers to enumerate
    users via a timing attack. Earlier, unsupported Django series (such as
    5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
    Django would like to thank Stackered for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2025-13473

- CVE-2025-14550:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a
    potential denial-of-service via a crafted request with multiple
    duplicate headers. Earlier, unsupported Django series (such as 5.0.x,
    4.1.x, and 3.2.x) were not evaluated and may also be affected. Django
    would like to thank Jiyong Yang for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2025-14550

- CVE-2026-1207:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented
    on PostGIS) allows remote attackers to inject SQL via the band index
    parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x,
    and 3.2.x) were not evaluated and may also be affected. Django would
    like to thank Tarek Nakkouch for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-1207

- CVE-2026-1285:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and
    `Truncator.words()` methods (with `html=True`) and the
    `truncatechars_html` and `truncatewords_html` template filters allow a
    remote attacker to cause a potential denial-of-service via crafted
    inputs containing a large number of unmatched HTML end tags. Earlier,
    unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not
    evaluated and may also be affected. Django would like to thank
    Seokchan Yoon for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-1285

- CVE-2026-1287:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in
    column aliases via control characters, using a suitably crafted
    dictionary, with dictionary expansion, as the `**kwargs` passed to
    `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`,
    `values_list()`, and `alias()`. Earlier, unsupported Django series
    (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be
    affected. Django would like to thank Solomon Kebede for reporting this
    issue.
    https://www.cve.org/CVERecord?id=CVE-2026-1287

- CVE-2026-1312:
    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and
    4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection
    in column aliases containing periods when the same alias is, using a
    suitably crafted dictionary, with dictionary expansion, used in
    `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x,
    4.1.x, and 3.2.x) were not evaluated and may also be affected. Django
    would like to thank Solomon Kebede for reporting this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-1312

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[thomas: update hash for inlines.js]
(cherry picked from commit f8e89786f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-02-16 18:12:20 +01:00
committed by Thomas Perale
parent 4f157b57e7
commit ff04f0eda2
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
package/python-django/python-django.hash
View File

@@ -1,12 +1,12 @@
# md5, sha256 from https://pypi.org/pypi/django/json
md5 98e667c17123f7bbd2d7d1db32f9ccdd django-5.2.10.tar.gz
sha256 74df100784c288c50a2b5cad59631d71214f40f72051d5af3fdf220c20bdbbbe django-5.2.10.tar.gz
md5 051357d45eb71a115a64e6d2a79c7c51 django-5.2.11.tar.gz
sha256 7f2d292ad8b9ee35e405d965fbbad293758b858c34bbf7f3df551aeeac6f02d3 django-5.2.11.tar.gz
# Locally computed sha256 checksums
sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE
sha256 dcac1c86cb7ab491702bdb4c41be680fafde51536748cc8aaee3840eec53ed17 django/contrib/gis/measure.py
sha256 570a045a8372b6cd6a00e30ebafe8e3e8dfc0a7fe3d4ef2cc5f16d419eb63aeb django/contrib/gis/gdal/LICENSE
sha256 08bf24b7551238ae325295245425b1caeb9ad0f42f9e2d303c7b353502632045 django/contrib/gis/geos/LICENSE
sha256 c9607e292c3f699995669222b4a75eee29b28006b7e8b05daa805f07b953bc94 django/contrib/admin/static/admin/js/inlines.js
sha256 d48633adb736dac091477ec2206feebeee88e3e6e486aedb21c584e4b49be0ec django/contrib/admin/static/admin/js/inlines.js
sha256 d4db9ebe6f29f5168eac45ad713f055623ac5d0dcd5ba92da23d650ae012020d django/contrib/admin/static/admin/js/vendor/jquery/LICENSE.txt
sha256 4ee0cbc51370afde358652a0f977972053729ed578b6a42f5e2a037d114f0b39 django/contrib/admin/static/admin/js/vendor/select2/LICENSE.md
sha256 73af2949bff9296cb0f816c3be19a4da4e95adc94c1f924796e8bad3f03f2f29 django/contrib/admin/static/admin/js/vendor/xregexp/LICENSE.txt

4
package/python-django/python-django.mk
View File

@@ -4,10 +4,10 @@
#
################################################################################
PYTHON_DJANGO_VERSION = 5.2.10
PYTHON_DJANGO_VERSION = 5.2.11
PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz
# The official Django site has an unpractical URL
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/e6/e5/2671df24bf0ded831768ef79532e5a7922485411a5696f6d979568591a37
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/17/f2/3e57ef696b95067e05ae206171e47a8e53b9c84eec56198671ef9eaa51a6
PYTHON_DJANGO_LICENSE = BSD-3-Clause, MIT (jquery, utils/archive.py), BSD-2-Clause (inlines.js)
PYTHON_DJANGO_LICENSE_FILES = LICENSE \
django/contrib/gis/measure.py \