Debian Patches

Status for python-django/3:3.2.25-0+deb12u2

Patch Description Author Forwarded Bugs Origin Last update
0001-disable-sources-in-sphinxdoc.diff Disable creation of _sources directory by Sphinx
We do this to save some space as the sources of the documentation
are not really useful in a binary package.
.
This is a Debian specific patch.		 Raphaël Hertzog <hertzog@debian.org> not-needed vendor 2015-10-11
0002-use_debian_geoip_database_as_default.diff Use Debian GeoIP database path as default
Default to Debian standard path for GeoIP directory and for GeoIP city
file. Avoids the need to declare them in each project.
.
This is a Debian specific patch.		 Tapio Rantala <tapio.rantala@iki.fi> not-needed debian 2015-10-11
0004-Use-locally-installed-documentation-sources.patch Use locally installed documentation sources Brian May <bam@debian.org> no 2017-06-24
0004-Set-the-default-shebang-to-new-projects-to-use-Pytho.patch Set the default shebang to new projects to use Python 3. Chris Lamb <lamby@debian.org> no 2017-09-24
0005-Use-usr-bin-env-python3-shebang-for-django-admin.py.patch Use #!/usr/bin/env python3 shebang for django-admin.py. Chris Lamb <lamby@debian.org> no 2017-09-26
0006-Fixed-32690-Fixed-__in-lookup-crash-when-combining-w.patch Fixed #32690 -- Fixed __in lookup crash when combining with filtered aggregates.

Having lookups group by subquery right-hand-sides is likely unnecessary
in the first place but relatively large amount of work would be needed
to achieve that such as making Lookup instances proper resolvable
expressions.

Regression in 35431298226165986ad07e91f9d3aca721ff38ec.

Thanks James A. Munsch for the report.

(cherry picked from commit 136ff592ad8aa8b7fa1e61435e5501cc98ce8573)		 Simon Charette <charette.s@gmail.com> no 2021-05-04
0007-Refs-32786-Made-Query.clear_ordering-not-to-cause-si.patch Refs #32786 -- Made Query.clear_ordering() not to cause side effects by default.

(cherry picked from commit 053141d31fe5aef1c255a1be183383860e0ccce9)		 Hannes Ljungberg <hannes.ljungberg@gmail.com> no 2021-05-26
0008-Refs-32690-Altered-lookups-Query-rhs-alterations-dur.patch Refs #32690 -- Altered lookups Query rhs alterations during initialization.

Having it happen at the lookup creation time ensures entry points
called before the compilation phase (e.g. get_group_by_cols) don't have
to duplicate the logic in charge of altering Query instances used as
rhs.

It also has the nice effect of reducing the amount of time the
alteration logic to once as opposed to multiple times if the queryset
is compiled more than once.

(cherry picked from commit e3bde71676a704e27d62e5f96dd967f7305db7f2)		 Simon Charette <charette.s@gmail.com> no 2021-12-01
0009-Fixed-33282-Fixed-a-crash-when-OR-ing-subquery-and-a.patch Fixed #33282 -- Fixed a crash when OR'ing subquery and aggregation lookups.

As a QuerySet resolves to Query the outer column references grouping logic
should be defined on the latter and proxied from Subquery for the cases where
get_group_by_cols is called on unresolved expressions.

Thanks Antonio Terceiro for the report and initial patch.

(cherry picked from commit e5a92d400acb4ca6a8e1375d1ab8121f2c7220be)		 Simon Charette <charette.s@gmail.com> no 2021-12-01
0011-Moved-RequestSite-import-to-the-toplevel.patch Moved RequestSite import to the toplevel.
Via https://github.com/django/django/commit/78163d1ac4407d59bfc5fdf1f84f2dbbb2ed3443		 Claude Paroz <claude@2xlibre.net> no 2021-11-11
0012-Add-Python-3.11-support-for-tests.patch Fix test_runner/test_utils tests on Python 3.11+.

Python 3.11 uses fully qualified test name in unittest output. See
https://github.com/python/cpython/commit/755be9b1505af591b9f2ee424a6525b6c2b65ce9
Python 3.11 while transitioning to Django 4.x		 Mariusz Felisiak <felisiak.mariusz@gmail.com> no upstream, https://github.com/django/django/commit/2ee4caf56b8e000cabbb73ad81ff05738d6d0a35 2023-01-06
0013-fix-url-validator.patch Fixed URLValidator crash in some edge cases Pedro Schlickmann Mendes <windowsxpedro@gmail.com> yes upstream upstream, https://github.com/django/django/commit/e8b4feddc34ffe5759ec21da8fa027e86e653f1c 2021-12-15
0014-CVE-2024-39329.patch [4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords.

Refs #20760.

Thanks Michael Manfre for the fix and to Adam Johnson for the review.		 Michael Manfre <mike@manfre.net> no 2024-06-14
0015-CVE-2024-39330.patch [4.2.x] Fixed CVE-2024-39330 -- Added extra file name validation in Storage's save method.

Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah
Boyce for the reviews.		 Natalia <124304+nessita@users.noreply.github.com> no 2024-03-20
0016-CVE-2024-39614.patch [4.2.x] Fixed CVE-2024-39614 -- Mitigated potential DoS in get_supported_language_variant().

Language codes are now parsed with a maximum length limit of 500 chars.

Thanks to MProgrammer for the report.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2024-06-26
0017-CVE-2024-41989.patch [4.2.x] Fixed CVE-2024-41989 -- Prevented excessive memory consumption in floatformat. MIME-Version: 1.0 Content-Type: text/plain;
charset=UTF-8 Content-Transfer-Encoding: 8bit

Thanks Elias Myllymäki for the report.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2024-07-12
0018-CVE-2024-41991.patch [4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget.

Thanks Seokchan Yoon for the report.		 Mariusz Felisiak <felisiak.mariusz@gmail.com> no 2024-07-10
0019-CVE-2024-42005.patch [4.2.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields.

Thanks Eyal (eyalgabay) for the report.		 Simon Charette <charette.s@gmail.com> no 2024-07-25
0020-CVE-2024-45231.patch [4.2.x] Fixed CVE-2024-45231 -- Avoided server error on password reset when email sending fails.

On successful submission of a password reset request, an email is sent
to the accounts known to the system. If sending this email fails (due to
email backend misconfiguration, service provider outage, network issues,
etc.), an attacker might exploit this by detecting which password reset
requests succeed and which ones generate a 500 error response.

Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam
Johnson, and Sarah Boyce for the reviews.		 Natalia <124304+nessita@users.noreply.github.com> no 2024-08-19
0021-CVE-2024-53907.patch [4.2.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags().

Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart
for the reviews.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2024-11-13
0022-CVE-2024-56374.patch [4.2.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.

Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz
Felisiak for the reviews.		 Natalia <124304+nessita@users.noreply.github.com> no 2025-01-06
0023-CVE-2025-13372.patch [4.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in column aliases on PostgreSQL.

Follow-up to CVE-2025-57833.

Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak
for the reviews.

Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.		 Jacob Walls <jacobtylerwalls@gmail.com> no 2025-11-17
0024-CVE-2025-26699.patch [4.2.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template filter.

Thanks sw0rd1ight for the report.

Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2025-02-25
0025-CVE-2025-32873.patch [4.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags(). MIME-Version: 1.0 Content-Type: text/plain;
charset=UTF-8 Content-Transfer-Encoding: 8bit

Thanks to Elias Myllymäki for the report, and Shai Berger and Jake
Howard for the reviews.


Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2025-04-08
0026-CVE-2025-48432.patch [4.2.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in `log_response()`.

Suitably crafted requests containing a CRLF sequence in the request
path may have allowed log injection, potentially corrupting log files,
obscuring other attacks, misleading log post-processing tools, or
forging log entries.

To mitigate this, all positional formatting arguments passed to the
logger are now escaped using "unicode_escape" encoding.

Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.


Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.		 Natalia <124304+nessita@users.noreply.github.com> no 2025-05-20
0027-CVE-2025-48432-2.patch [4.2.x] Refs CVE-2025-48432 -- Prevented log injection in remaining response logging.

Migrated remaining response-related logging to use the `log_response()`
helper to avoid potential log injection, to ensure untrusted values like
request paths are safely escaped.


Backport of 957951755259b412d5113333b32bf85871d29814 from main.		 Jake Howard <git@theorangeone.net> no 2025-06-04
0028-CVE-2025-57833.patch [4.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

Thanks Eyal Gabay (EyalSec) for the report.

Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.		 Jake Howard <git@theorangeone.net> no 2025-08-13
0029-CVE-2025-59681.patch [4.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(),
and extra() against SQL injection in column aliases on MySQL/MariaDB.

Thanks sw0rd1ight for the report.

Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.

Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.		 Mariusz Felisiak <felisiak.mariusz@gmail.com> no 2025-09-10
0030-CVE-2025-59682.patch [4.2.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal via archive.extract().

Thanks stackered for the report.

Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23.

Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.		 Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> no 2025-09-16
0031-CVE-2025-64459.patch [4.2.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg.

Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon
Charette, and Jake Howard for the reviews.

Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.		 Jacob Walls <jacobtylerwalls@gmail.com> no 2025-09-24
0032-CVE-2025-64460.patch [4.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML serializer.

Previously, `getInnerText()` recursively used `list.extend()` on strings,
which added each character from child nodes as a separate list element.
On deeply nested XML content, this caused the overall deserialization
work to grow quadratically with input size, potentially allowing
disproportionate CPU consumption for crafted XML.

The fix separates collection of inner texts from joining them, so that
each subtree is joined only once, reducing the complexity to linear in
the size of the input. These changes also include a mitigation for a
xml.dom.minidom performance issue.

Thanks Seokchan Yoon (https://ch4n3.kr/) for report.


Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.		 Shai Berger <shai@platonix.com> no 2025-10-11
0034-CVE-2025-13473.patch [4.2.x] Fixed CVE-2025-13473 -- Standardized timing of check_password() in mod_wsgi auth handler.

Refs CVE-2024-39329, #20760.

Thanks Stackered for the report, and Jacob Walls and Markus Holtermann
for the reviews.


Backport of 3eb814e02a4c336866d4189fa0c24fd1875863ed from main.		 Jake Howard <git@theorangeone.net> no 2025-11-19
0035-CVE-2025-14550.patch [4.2.x] Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI requests.

Thanks Jiyong Yang for the report, and Natalia Bidart, Jacob Walls, and
Shai Berger for reviews.

Backport of eb22e1d6d643360e952609ef562c139a100ea4eb from main.		 Jake Howard <git@theorangeone.net> no 2026-01-14
0036-CVE-2026-1207.patch [4.2.x] Fixed CVE-2026-1207 -- Prevented SQL injections in RasterField lookups via band index.

Thanks Tarek Nakkouch for the report, and Simon Charette for the initial
triage and review.

Backport of 81aa5292967cd09319c45fe2c1a525ce7b6684d8 from main.		 Jacob Walls <jacobtylerwalls@gmail.com> no 2026-01-19
0037-CVE-2026-1285.patch [4.2.x] Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.Truncator for HTML input.

The `TruncateHTMLParser` used `deque.remove()` to remove tags from the
stack when processing end tags. With crafted input containing many
unmatched end tags, this caused repeated full scans of the tag stack,
leading to quadratic time complexity.

The fix uses LIFO semantics, only removing a tag from the stack when it
matches the most recently opened tag. This avoids linear scans for
unmatched end tags and reduces complexity to linear time.

Refs #30686 and 6ee37ada3241ed263d8d1c2901b030d964cbd161.

Thanks Seokchan Yoon for the report.

Backport of a33540b3e20b5d759aa8b2e4b9ca0e8edd285344 from main.		 Natalia <124304+nessita@users.noreply.github.com> no 2026-01-21
0038-CVE-2026-1287.patch [4.2.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

Control characters in FilteredRelation column aliases could be used for
SQL injection attacks. This affected QuerySet.annotate(), aggregate(),
extra(), values(), values_list(), and alias() when using dictionary
expansion with **kwargs.

Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls,
and Natalia Bidart for reviews.

Backport of e891a84c7ef9962bfcc3b4685690219542f86a22 from main.		 Jake Howard <git@theorangeone.net> no 2026-01-21
0039-CVE-2026-1312.patch [4.2.x] Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.

Before, `order_by()` treated a period in a field name as a sign that it
was requested via `.extra(order_by=...)` and thus should be passed
through as raw table and column names, even if `extra()` was not used.
Since periods are permitted in aliases, this meant user-controlled
aliases could force the `order_by()` clause to resolve to a raw table
and column pair instead of the actual target field for the alias.

In practice, only `FilteredRelation` was affected, as the other
expressions we tested, e.g. `F`, aggressively optimize away the ordering
expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY
"table".column.

Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard
for reviews.

Backport of 69065ca869b0970dff8fdd8fafb390bf8b3bf222 from main.		 Jacob Walls <jacobtylerwalls@gmail.com> no 2026-01-21

All known versions for source package 'python-django'

Links