Package "python3-django"
| Name: |
python3-django
|
Description: |
High-level Python web development framework
|
| Latest version: |
3:5.2.9-0ubuntu4.3 |
| Release: |
resolute (26.04) |
| Level: |
updates |
| Repository: |
main |
| Head package: |
python-django |
| Homepage: |
http://www.djangoproject.com/ |
Links
Download "python3-django"
Other versions of "python3-django" in Resolute
Changelog
|
python-django (3:5.2.9-0ubuntu4.3) resolute-security; urgency=medium
* SECURITY UPDATE: Server-side file write and request forgery via spatial
lookups
- debian/patches/CVE-2026-15307.patch: blocked raster strings and dicts
in spatial lookups. in
django/contrib/gis/db/models/fields.py,
django/contrib/gis/gdal/raster/source.py,
docs/ref/contrib/gis/db-api.txt,
docs/ref/contrib/gis/gdal.txt, tests/gis_tests/geoadmin/tests.py,
tests/gis_tests/geoapp/tests.py,
tests/gis_tests/rasterapp/test_rasterfield.py,
tests/gis_tests/test_geoforms.py.
- CVE-2026-15307
* SECURITY UPDATE: Potential exposure of private data via case-sensitive
Cache-Control directives in UpdateCacheMiddleware
- debian/patches/CVE-2026-8404.patch: use Cache-Control directives
case-insensitively in UpdateCacheMiddleware. in
django/middleware/cache.py, tests/cache/tests.py.
- CVE-2026-8404
-- Hurman Mon, 28 Sep 2026 16:50:14 +0800
|
| Source diff to previous version |
| CVE-2026-15307 |
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as |
| CVE-2026-8404 |
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `C |
|
|
python-django (3:5.2.9-0ubuntu4.1) resolute-security; urgency=medium
* SECURITY UPDATE: Potential denial-of-service vulnerability in ASGI
requests via file upload limit bypass
- debian/patches/CVE-2026-5766.patch: enforce
DATA_UPLOAD_MAX_MEMORY_SIZE in MemoryFileUploadHandler on ASGI in
django/core/files/uploadhandler.py, tests/asgi/tests.py,
tests/requests_tests/tests.py.
- CVE-2026-5766
* SECURITY UPDATE: Session fixation via public cached pages and
SESSION_SAVE_EVERY_REQUEST
- debian/patches/CVE-2026-35192.patch: ensure Vary header is sent when
setting session cookie with SESSION_SAVE_EVERY_REQUEST=True in
django/contrib/sessions/middleware.py, tests/sessions_tests/tests.py.
- CVE-2026-35192
* SECURITY UPDATE: Potential exposure of private data due to incorrect
handling of Vary: * in UpdateCacheMiddleware
- debian/patches/CVE-2026-6907.patch: prevent caching of requests when
Vary header contains an asterisk in django/middleware/cache.py,
tests/cache/tests.py.
- CVE-2026-6907
-- Marc Deslauriers <email address hidden> Tue, 28 Apr 2026 13:35:31 -0400
|
About
-
Send Feedback to @ubuntu_updates
