Debian Patches

Status for python-django/3:3.2.25-0+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
0001-disable-sources-in-sphinxdoc.diff Disable creation of _sources directory by Sphinx
We do this to save some space as the sources of the documentation
are not really useful in a binary package.
.
This is a Debian specific patch.		 Raphaël Hertzog <hertzog@debian.org> not-needed vendor 2015-10-11
0002-use_debian_geoip_database_as_default.diff Use Debian GeoIP database path as default
Default to Debian standard path for GeoIP directory and for GeoIP city
file. Avoids the need to declare them in each project.
.
This is a Debian specific patch.		 Tapio Rantala <tapio.rantala@iki.fi> not-needed debian 2015-10-11
0004-Use-locally-installed-documentation-sources.patch Use locally installed documentation sources Brian May <bam@debian.org> no 2017-06-24
0004-Set-the-default-shebang-to-new-projects-to-use-Pytho.patch Set the default shebang to new projects to use Python 3. Chris Lamb <lamby@debian.org> no 2017-09-24
0005-Use-usr-bin-env-python3-shebang-for-django-admin.py.patch Use #!/usr/bin/env python3 shebang for django-admin.py. Chris Lamb <lamby@debian.org> no 2017-09-26
0006-Fixed-32690-Fixed-__in-lookup-crash-when-combining-w.patch Fixed #32690 -- Fixed __in lookup crash when combining with filtered aggregates.

Having lookups group by subquery right-hand-sides is likely unnecessary
in the first place but relatively large amount of work would be needed
to achieve that such as making Lookup instances proper resolvable
expressions.

Regression in 35431298226165986ad07e91f9d3aca721ff38ec.

Thanks James A. Munsch for the report.

(cherry picked from commit 136ff592ad8aa8b7fa1e61435e5501cc98ce8573)		 Simon Charette <charette.s@gmail.com> no 2021-05-04
0007-Refs-32786-Made-Query.clear_ordering-not-to-cause-si.patch Refs #32786 -- Made Query.clear_ordering() not to cause side effects by default.

(cherry picked from commit 053141d31fe5aef1c255a1be183383860e0ccce9)		 Hannes Ljungberg <hannes.ljungberg@gmail.com> no 2021-05-26
0008-Refs-32690-Altered-lookups-Query-rhs-alterations-dur.patch Refs #32690 -- Altered lookups Query rhs alterations during initialization.

Having it happen at the lookup creation time ensures entry points
called before the compilation phase (e.g. get_group_by_cols) don't have
to duplicate the logic in charge of altering Query instances used as
rhs.

It also has the nice effect of reducing the amount of time the
alteration logic to once as opposed to multiple times if the queryset
is compiled more than once.

(cherry picked from commit e3bde71676a704e27d62e5f96dd967f7305db7f2)		 Simon Charette <charette.s@gmail.com> no 2021-12-01
0009-Fixed-33282-Fixed-a-crash-when-OR-ing-subquery-and-a.patch Fixed #33282 -- Fixed a crash when OR'ing subquery and aggregation lookups.

As a QuerySet resolves to Query the outer column references grouping logic
should be defined on the latter and proxied from Subquery for the cases where
get_group_by_cols is called on unresolved expressions.

Thanks Antonio Terceiro for the report and initial patch.

(cherry picked from commit e5a92d400acb4ca6a8e1375d1ab8121f2c7220be)		 Simon Charette <charette.s@gmail.com> no 2021-12-01
0011-Moved-RequestSite-import-to-the-toplevel.patch Moved RequestSite import to the toplevel.
Via https://github.com/django/django/commit/78163d1ac4407d59bfc5fdf1f84f2dbbb2ed3443		 Claude Paroz <claude@2xlibre.net> no 2021-11-11
0012-Add-Python-3.11-support-for-tests.patch Fix test_runner/test_utils tests on Python 3.11+.

Python 3.11 uses fully qualified test name in unittest output. See
https://github.com/python/cpython/commit/755be9b1505af591b9f2ee424a6525b6c2b65ce9
Python 3.11 while transitioning to Django 4.x		 Mariusz Felisiak <felisiak.mariusz@gmail.com> no upstream, https://github.com/django/django/commit/2ee4caf56b8e000cabbb73ad81ff05738d6d0a35 2023-01-06
0013-fix-url-validator.patch Fixed URLValidator crash in some edge cases Pedro Schlickmann Mendes <windowsxpedro@gmail.com> yes upstream upstream, https://github.com/django/django/commit/e8b4feddc34ffe5759ec21da8fa027e86e653f1c 2021-12-15
0014-CVE-2024-39329.patch [4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords.

Refs #20760.

Thanks Michael Manfre for the fix and to Adam Johnson for the review.		 Michael Manfre <mike@manfre.net> no 2024-06-14
0015-CVE-2024-39330.patch [4.2.x] Fixed CVE-2024-39330 -- Added extra file name validation in Storage's save method.

Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah
Boyce for the reviews.		 Natalia <124304+nessita@users.noreply.github.com> no 2024-03-20
0016-CVE-2024-39614.patch [4.2.x] Fixed CVE-2024-39614 -- Mitigated potential DoS in get_supported_language_variant().

Language codes are now parsed with a maximum length limit of 500 chars.

Thanks to MProgrammer for the report.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2024-06-26
0017-CVE-2024-41989.patch [4.2.x] Fixed CVE-2024-41989 -- Prevented excessive memory consumption in floatformat. MIME-Version: 1.0 Content-Type: text/plain;
charset=UTF-8 Content-Transfer-Encoding: 8bit

Thanks Elias Myllymäki for the report.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2024-07-12
0018-CVE-2024-41991.patch [4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget.

Thanks Seokchan Yoon for the report.		 Mariusz Felisiak <felisiak.mariusz@gmail.com> no 2024-07-10
0019-CVE-2024-42005.patch [4.2.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields.

Thanks Eyal (eyalgabay) for the report.		 Simon Charette <charette.s@gmail.com> no 2024-07-25
0020-CVE-2024-45231.patch [4.2.x] Fixed CVE-2024-45231 -- Avoided server error on password reset when email sending fails.

On successful submission of a password reset request, an email is sent
to the accounts known to the system. If sending this email fails (due to
email backend misconfiguration, service provider outage, network issues,
etc.), an attacker might exploit this by detecting which password reset
requests succeed and which ones generate a 500 error response.

Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam
Johnson, and Sarah Boyce for the reviews.		 Natalia <124304+nessita@users.noreply.github.com> no 2024-08-19
0021-CVE-2024-53907.patch [4.2.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags().

Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart
for the reviews.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2024-11-13
0022-CVE-2024-56374.patch [4.2.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.

Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz
Felisiak for the reviews.		 Natalia <124304+nessita@users.noreply.github.com> no 2025-01-06
0023-CVE-2025-13372.patch [4.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in column aliases on PostgreSQL.

Follow-up to CVE-2025-57833.

Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak
for the reviews.

Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.		 Jacob Walls <jacobtylerwalls@gmail.com> no 2025-11-17
0024-CVE-2025-26699.patch [4.2.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template filter.

Thanks sw0rd1ight for the report.

Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2025-02-25
0025-CVE-2025-32873.patch [4.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags(). MIME-Version: 1.0 Content-Type: text/plain;
charset=UTF-8 Content-Transfer-Encoding: 8bit

Thanks to Elias Myllymäki for the report, and Shai Berger and Jake
Howard for the reviews.


Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2025-04-08
0026-CVE-2025-48432.patch [4.2.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in `log_response()`.

Suitably crafted requests containing a CRLF sequence in the request
path may have allowed log injection, potentially corrupting log files,
obscuring other attacks, misleading log post-processing tools, or
forging log entries.

To mitigate this, all positional formatting arguments passed to the
logger are now escaped using "unicode_escape" encoding.

Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.


Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.		 Natalia <124304+nessita@users.noreply.github.com> no 2025-05-20
0027-CVE-2025-48432-2.patch [4.2.x] Refs CVE-2025-48432 -- Prevented log injection in remaining response logging.

Migrated remaining response-related logging to use the `log_response()`
helper to avoid potential log injection, to ensure untrusted values like
request paths are safely escaped.


Backport of 957951755259b412d5113333b32bf85871d29814 from main.		 Jake Howard <git@theorangeone.net> no 2025-06-04
0028-CVE-2025-57833.patch [4.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

Thanks Eyal Gabay (EyalSec) for the report.

Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.		 Jake Howard <git@theorangeone.net> no 2025-08-13
0029-CVE-2025-59681.patch [4.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(),
and extra() against SQL injection in column aliases on MySQL/MariaDB.

Thanks sw0rd1ight for the report.

Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.

Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.		 Mariusz Felisiak <felisiak.mariusz@gmail.com> no 2025-09-10
0030-CVE-2025-59682.patch [4.2.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal via archive.extract().

Thanks stackered for the report.

Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23.

Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2025-09-16
0031-CVE-2025-64459.patch [4.2.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg.

Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon
Charette, and Jake Howard for the reviews.

Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.		 Jacob Walls <jacobtylerwalls@gmail.com> no 2025-09-24
0032-CVE-2025-64460.patch [4.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML serializer.

Previously, `getInnerText()` recursively used `list.extend()` on strings,
which added each character from child nodes as a separate list element.
On deeply nested XML content, this caused the overall deserialization
work to grow quadratically with input size, potentially allowing
disproportionate CPU consumption for crafted XML.

The fix separates collection of inner texts from joining them, so that
each subtree is joined only once, reducing the complexity to linear in
the size of the input. These changes also include a mitigation for a
xml.dom.minidom performance issue.

Thanks Seokchan Yoon (https://ch4n3.kr/) for report.


Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.		 Shai Berger <shai@platonix.com> no 2025-10-11

All known versions for source package 'python-django'

Links