mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-31 19:51:06 -09:00
c47ac4aa46
Fixes the following security issues:
CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra()
QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL
injection in column aliases, using a suitably crafted dictionary, with
dictionary expansion, as the **kwargs passed to these methods.
CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL
QuerySet.explain() method was subject to SQL injection in option names,
using a suitably crafted dictionary, with dictionary expansion, as the
**options argument.
For more details, see the advisory:
https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 87b8676fbf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
19 lines
676 B
Makefile
19 lines
676 B
Makefile
################################################################################
|
|
#
|
|
# python-django
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_DJANGO_VERSION = 4.0.4
|
|
PYTHON_DJANGO_SOURCE = Django-$(PYTHON_DJANGO_VERSION).tar.gz
|
|
# The official Django site has an unpractical URL
|
|
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/d2/95/93d1f75da95624bf89e373d079fa72debf77f9b10acc31998cc52a5ff3f9
|
|
|
|
PYTHON_DJANGO_LICENSE = BSD-3-Clause
|
|
PYTHON_DJANGO_LICENSE_FILES = LICENSE
|
|
PYTHON_DJANGO_CPE_ID_VENDOR = djangoproject
|
|
PYTHON_DJANGO_CPE_ID_PRODUCT = django
|
|
PYTHON_DJANGO_SETUP_TYPE = setuptools
|
|
|
|
$(eval $(python-package))
|