Accepted python-django 2:2.2.28-1~deb11u13 (source) into oldoldstable-security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 10 Aug 2026 13:44:08 -0700
Source: python-django
Architecture: source
Version: 2:2.2.28-1~deb11u13
Distribution: bullseye-security
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Changes:
 python-django (2:2.2.28-1~deb11u13) bullseye-security; urgency=high
 .
   * Non-maintainer upload by the LTS security team.
   * CVE-2026-15337: Avoid a potential denial-of-service vulnerability in the
     check_for_language() method in the django.utils.translation method. This
     was subject to a potential denial-of-service (DoS) attack when checking
     many distinct, very long language codes. To mitigate this vulnerability,
     language codes longer than 500 characters are now rejected before the
     cached lookup.
   * CVE-2026-15920: Prevent a potential cross-site scripting (XSS) attack via
     URLField values in the Django admin. The admin renders URLField values as
     clickable links on changelist views and read-only fields. The link was
     generated without validating the value as a safe URL, so a stored value
     using a potentially dangerous scheme was rendered as a link. URLField
     values shown via display_for_field are now validated using URLValidator
     before a link is rendered and displayed as plain text if validation is
     failed.
Checksums-Sha1:
 61d3ea8fb70fdc046d44c96e43b5ba1f5b614bc3 2842 python-django_2.2.28-1~deb11u13.dsc
 0661bddaeca016d84abc4c808c1c677cd7d4aa7b 9187543 python-django_2.2.28.orig.tar.gz
 04e45a7d2c09d881fee3c55b87cd1abe47b10544 72092 python-django_2.2.28-1~deb11u13.debian.tar.xz
 367f87e554172331acdaf879c2227de2b15990ca 8411 python-django_2.2.28-1~deb11u13_source.buildinfo
Checksums-Sha256:
 9834a57c35d37fdbc2925052b2075236c9a50dfd9662e990556ded033be38fcb 2842 python-django_2.2.28-1~deb11u13.dsc
 0200b657afbf1bc08003845ddda053c7641b9b24951e52acd51f6abda33a7413 9187543 python-django_2.2.28.orig.tar.gz
 c0d542630fd94e7247d63b9ec95d0aaaa387bcc1ee18861f6eece54790475ece 72092 python-django_2.2.28-1~deb11u13.debian.tar.xz
 6ec695d88e548f4f4d6c98ecb69ca4610dab2fa5e9b36ecade5c2230da8ebb95 8411 python-django_2.2.28-1~deb11u13_source.buildinfo
Files:
 2b558b6c29d2f9646032fb08882d8bbe 2842 python optional python-django_2.2.28-1~deb11u13.dsc
 62550f105ef66ac7d08e0126f457578a 9187543 python optional python-django_2.2.28.orig.tar.gz
 1c057f78015bae743d76b17602a3eb00 72092 python optional python-django_2.2.28-1~deb11u13.debian.tar.xz
 219620012617a9ca3e8a1ec50ed7503c 8411 python optional python-django_2.2.28-1~deb11u13_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmp82PgACgkQHpU+J9Qx
Hlj9ig//dRAgVJ4fzQrrs8s+CQeg8VB0OPRTq0PB0BRUSMhvSyAK01QHh9Glsi4k
YufSTSc6aFeCnjYPJ0mBKo8yY4m15wi2AT3AN/lfPdvVj1FChI0HBBb9BAXYJtpe
l4rPDxtwM+SdaXfIP50Lic90FhTa8yVL5wC44qoIO4SKV/aKFYU+XjnUjVb1FGeg
nta+tDSennK2xhdVYg43NOfWlk9Uw32EuBRZk56LQxHgAT6tBiGbtEr1QM3xzG90
ZI/SL+pbAwF6DbXqKxdifx3G4vaj0O3toG6oWVXbDzfNOLZobA5xyfL2rdr8aCzo
lcacMgBuBCB07q6544qWxsiZv2jBEhRcAqulLBKaiYm0PXnfYjV27f/L/Q9wQrrw
e/83LKelXy4CNLJa631qe00m63/wBrJdYbEkne1ws2+PAlOIRmnS6dCmiMMOvrqY
PW1m5Z2hXVXSG7TdslptvbxGgum06c3tEZdW8iI5MGiGE+f/uI77K6XERo6h4sUR
Jz55x9w3e1KMMYx5dOxnP9Bny8ES7FmOGyZ89X73hsCUAv1YEM3zMIygdaabqfF+
p/aQvP/ybgVad7wqTDNNRF+hNfIc30ziIiVdwrPs0xdrdCeFRTrxly/Pp1KTezXZ
qLD2OYn16/P0eWabXMoiApHCCthq2WJb0LHjOSz7GBossXZu6QM=
=hGbd
-----END PGP SIGNATURE-----