 Darsh Kelaiya
|
8ee24af3c6
|
python3-django: fix CVE-2026-15830
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
[1] https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15830
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
|
2026-09-01 10:18:00 +05:30 |
|
|
Darsh Kelaiya
|
e1fadab9dd
|
python3-django: fix CVE-2026-15337
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
[1] https://github.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15337
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
|
2026-09-01 10:17:59 +05:30 |
|
|
Darsh Kelaiya
|
3bc6095e25
|
python3-django: fix CVE-2026-15307
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
[1] https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15307
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
|
2026-09-01 10:17:59 +05:30 |
|
 Haixiao Yan
|
9757d0151b
|
python3-django: fix CVE-2025-59681
QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and
QuerySet.extra() methods were subject to SQL injection in column aliases, using
a suitably crafted dictionary, with dictionary expansion, as the **kwargs
passed to these methods on MySQL and MariaDB.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-59681
Upstream-patch:
https://github.com/django/django/commit/38d9ef8c7b5cb6ef51b933e51a20e0e0063f33d5
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
|
2026-04-15 14:12:18 +05:30 |
|
|
Haixiao Yan
|
838ca22808
|
python3-django: fix CVE-2025-57833
FilteredRelation was subject to SQL injection in column aliases, using a
suitably crafted dictionary, with dictionary expansion, as the **kwargs
passed QuerySet.annotate() or QuerySet.alias().
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-57833
Upstream-patch:
https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
|
2026-04-15 14:12:18 +05:30 |
|
|
Haixiao Yan
|
151e634ed2
|
python3-django: fix CVE-2025-64459
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the
class Q() were subject to SQL injection when using a suitably crafted
dictionary, with dictionary expansion, as the _connector argument.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-64459
https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
Upstream-patch:
https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
https://github.com/django/django/commit/4624ed769c0f7caea0d48ac824a75fa6b6f17671
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
|
2026-04-15 14:10:33 +05:30 |
|
 Gyorgy Sarvari
|
4e29baa804
|
python3-django: patch CVE-2025-64460
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64460
Backport the patch that explicitly references this CVE in its
commit message.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
|
2026-02-12 13:38:12 +05:30 |
|
 Ankur Tyagi
|
873297afaa
|
python3-django: upgrade 5.0.11 -> 5.0.14
Drop patch merged in the upstream.
Release notes:
https://docs.djangoproject.com/en/dev/releases/5.0.12/
https://docs.djangoproject.com/en/dev/releases/5.0.13/
https://docs.djangoproject.com/en/dev/releases/5.0.14/
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
|
2025-12-09 07:01:20 +05:30 |
|