cbb64ac48d
This fixes the following vulnerabilities:
- CVE-2025-59681:
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before
5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(),
QuerySet.aggregate(), and QuerySet.extra() are subject to SQL
injection in column aliases, when using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to these methods (on
MySQL and MariaDB).
https://www.cve.org/CVERecord?id=CVE-2025-59681
- CVE-2025-59682:
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before
5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract()
function, used by the "startapp --template" and "startproject
--template" commands, allows partial directory traversal via an
archive with file paths sharing a common prefix with the target
directory.
https://www.cve.org/CVERecord?id=CVE-2025-59682
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 7bbc66a39e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
28 lines
1.2 KiB
Makefile
28 lines
1.2 KiB
Makefile
################################################################################
|
|
#
|
|
# python-django
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_DJANGO_VERSION = 5.1.13
|
|
PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz
|
|
# The official Django site has an unpractical URL
|
|
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/bb/57/ad9905d03a2ee39064ee7ba69f8e2790db4a7ffaef9c54f95e7a8f2cb0a1
|
|
PYTHON_DJANGO_LICENSE = BSD-3-Clause, MIT (jquery, utils/archive.py), BSD-2-Clause (inlines.js)
|
|
PYTHON_DJANGO_LICENSE_FILES = LICENSE \
|
|
django/contrib/gis/measure.py \
|
|
django/contrib/gis/gdal/LICENSE \
|
|
django/contrib/gis/geos/LICENSE \
|
|
django/contrib/admin/static/admin/js/inlines.js \
|
|
django/contrib/admin/static/admin/js/vendor/jquery/LICENSE.txt \
|
|
django/contrib/admin/static/admin/js/vendor/select2/LICENSE.md \
|
|
django/contrib/admin/static/admin/js/vendor/xregexp/LICENSE.txt \
|
|
django/contrib/admin/static/admin/img/LICENSE \
|
|
django/dispatch/license.txt \
|
|
django/utils/archive.py
|
|
PYTHON_DJANGO_CPE_ID_VENDOR = djangoproject
|
|
PYTHON_DJANGO_CPE_ID_PRODUCT = django
|
|
PYTHON_DJANGO_SETUP_TYPE = setuptools
|
|
|
|
$(eval $(python-package))
|