mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-16 03:04:04 -09:00
63ae2c9f75
See the release notes: https://docs.djangoproject.com/en/5.2/releases/5.2.13/ In addition, update the pypi url to a stable one, which shouldn't change in each and every release (similar to the url change in commit60ce218196) Finally, one hash file has changed because of upstream commit0ee44c674cDjango 5.2.13 fixes one security issue with severity "moderate", and four security issues with severity "low": - CVE-2026-3902: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue. https://www.cve.org/CVERecord?id=CVE-2026-3902 - CVE-2026-4277: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue. https://www.cve.org/CVERecord?id=CVE-2026-4277 - CVE-2026-4292: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue. https://www.cve.org/CVERecord?id=CVE-2026-4292 - CVE-2026-33033: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content- Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. https://www.cve.org/CVERecord?id=CVE-2026-33033 - CVE-2026-33034: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue. https://www.cve.org/CVERecord?id=CVE-2026-33034 Signed-off-by: Titouan Christophe <titouan.christophe@mind.be> Signed-off-by: Thomas Perale <thomas.perale@mind.be>