-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 10 Aug 2026 13:44:36 -0700 Source: python-django Architecture: source Version: 3:3.2.25-0+deb12u4 Distribution: bookworm-security Urgency: high Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Chris Lamb <lamby@debian.org> Changes: python-django (3:3.2.25-0+deb12u4) bookworm-security; urgency=high . * Non-maintainer upload by the LTS security team. * CVE-2026-15337: Avoid a potential denial-of-service vulnerability in the check_for_language() method in the django.utils.translation method. This was subject to a potential denial-of-service (DoS) attack when checking many distinct, very long language codes. To mitigate this vulnerability, language codes longer than 500 characters are now rejected before the cached lookup. * CVE-2026-15920: Prevent a potential cross-site scripting (XSS) attack via URLField values in the Django admin. The admin renders URLField values as clickable links on changelist views and read-only fields. The link was generated without validating the value as a safe URL, so a stored value using a potentially dangerous scheme was rendered as a link. URLField values shown via display_for_field are now validated using URLValidator before a link is rendered and displayed as plain text if validation is failed. Checksums-Sha1: 9f579a9e3e5d18e5c0c185cbe6b492ac849396c0 2837 python-django_3.2.25-0+deb12u4.dsc a706db3607e3cc567ea4a172589f1360a614a6c6 9836336 python-django_3.2.25.orig.tar.gz 7fff3a9a60f1c16bcf97ecf9b939ee56350774da 68644 python-django_3.2.25-0+deb12u4.debian.tar.xz e8cd8d4af2d5dc10178433acfe68b5c38c467127 8103 python-django_3.2.25-0+deb12u4_source.buildinfo Checksums-Sha256: 4eecb58a3d27737072cdf063b03bc4e2866fbecb1b5045a852d59ab4d4444b26 2837 python-django_3.2.25-0+deb12u4.dsc 7ca38a78654aee72378594d63e51636c04b8e28574f5505dff630895b5472777 9836336 python-django_3.2.25.orig.tar.gz df5b8b5e327d4ce1ac5d8ee4726b51eb0b4c0af2456c459f3af0f4fef0993fab 68644 python-django_3.2.25-0+deb12u4.debian.tar.xz 71408746ecba559db86e8c36ec7e6626a50303fa75a1ce76d9060edacf25a69d 8103 python-django_3.2.25-0+deb12u4_source.buildinfo Files: 91d0d914f33f442c3f300ec979395245 2837 python optional python-django_3.2.25-0+deb12u4.dsc a16a8c39121acf9a84433bf0c616d575 9836336 python optional python-django_3.2.25.orig.tar.gz 85dd5b126219bc07346393d3c8ee8fb2 68644 python optional python-django_3.2.25-0+deb12u4.debian.tar.xz a658e695a68dd3c9dde261078a57604f 8103 python optional python-django_3.2.25-0+deb12u4_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmp82ZcACgkQHpU+J9Qx HlhADw//WF+KfUXh/WKEvmZMmA9HedrR/4bxQbEambkcw22Av3X3m+X9ZCaoSeJ7 xERqiL1oWdsYiBE8Dwqh1IdLfT8AwJtfXDV45kxKyn5ST/Z46THuHT9hMXfkW/+K +01tZd2oOvY0wYAwDoecCDn+ad9g5EiZ9aMTw9xLHjZdqPHAVNmzxSuGRWSg0yyY w2Y/rh8mwnLZ/01ZHQcx1cLN9Z6z4puK3JM2+QoaPoLnogb7aO5jEc7/a7KUYJFM U25ZlKgNrSwiZjTaXms0DKGkI/T8Y25ZpNgO8UoVKb09cbvsjV5etBjjkgQ+3Ivs RiBGoohZBsST/GwIjfDktaxy0ylKF8J3SCVNLQ+Fjy5vbwCK+c0KDz8/COCmmoua NTFAA5IqTTprTSOPQZJyvrCHlPga1IsYI1DtBZb+0yfKvZ24N6P/B6wKsmxkPGaj 60AZHxebr1XTgMTqV/aMO6bikbJhhN6PFUfwJLrDvMl6MuOoGDhy9snCN0m89+SP E6Q2z0A7QknUchXiJ9xmLQ0kUTLPMh9cAYqNSlC5brwYVOQD9Gt+kz20C9o/85m+ zw6MJHV9/bcplexKqA6G91iyIW9w9wOArHP5keFZKmeY/mfdFvyC5qmY9OBOXk05 LlUqFhVm0vkclSBXVpjuWUrlXMzFVLqdaE8cbMRx2Dx4u5U9JO4= =48JW -----END PGP SIGNATURE-----
