-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 09:39:58 -0800 Source: python-django Binary: python-django-doc python3-django Built-For-Profiles: nocheck Architecture: source all Version: 3:5.2.19-1~bpo13+1 Distribution: trixie-backports Urgency: high Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Chris Lamb <lamby@debian.org> Description: python-django-doc - High-level Python web development framework (documentation) python3-django - High-level Python web development framework Closes: 1126323 1150176 1152952 Changes: python-django (3:5.2.19-1~bpo13+1) trixie-backports; urgency=medium . * Rebuild for trixie-backports. . python-django (3:5.2.19-1) unstable; urgency=high . * New upstream security release: . - CVE-2026-108147: Prevent a potential memory exhaustion in MultiPartParser via base64-encoded file uploads. When using django.http.multipartparser's MultiPartParser, multipart uploads with a "Content-Transfer-Encoding: base64" header could be buffered entirely in memory regardless of the value of FILE_UPLOAD_MAX_MEMORY_SIZE before being passed to upload handlers, potentially consuming excessive memory. . - CVE-2026-111211: Avoid a potential log injection via unescaped geometry form values. django.contrib.gis.forms.GeometryField (and its widgets) logged invalid submitted values directly, allowing control characters (e.g. newlines or ANSI escape sequences) to be written unescaped into logs. This could have enabled log injection or forgery, letting attackers manipulate log appearances and structures, especially in logs processed by external systems or when viewed in terminals. . - CVE-2026-111362: Fix a server-side request forgery via the 'crs' member of GeoJSON geometries. Earlier versions of the GeoJSON spec allowed specifying a coordinate reference system (CRS) by URL. Since GDAL still resolves these URLs, any validation, save or query path where a geometry is instantiated from user input allowed an attacker to submit a malicious CRS that would make a network request as the Django process user or read a file (or both). Lookups against spatial fields, the GeometryField form field and GEOSGeometry now reject GeoJSON geometries with CRS references to external resources. The DataSource and LayerMapping utilities for loading trusted data continue to accept these values, however. . - CVE-2026-113593: Avoid a potential exposure of private data via empty and missing 'Vary' headers. UpdateCacheMiddleware and cache_page() generated the same cache key for a request that omitted a header listed in the response's 'Vary' header and a request that sent that header with an empty value. As a result, a response cached for one of these requests could be served to the other which could lead to the exposure of private data. Cache keys now distinguish between absent and empty header values as required by RFC 9111#section-4.1. Responses previously cached for requests that omitted a header listed in 'Vary' will no longer be matched and will be cached again on the next request. . - CVE-2026-114582: Avoid a server-side request forgery via SpatialReference string input. SpatialReference passed string input to GDAL, which by default resolves URLs and reads files. This behavior was not previously documented by Django. (Other affected methods included GEOSGeometry.transform, OGRGeometry.transform, GDALRaster.transform, the srs setter of OGRGeometry and the srs and srid setters of GDALRaster.) A URL or file path reaching any of these would issue an outbound request or read a file as the Django process user. The attack vectors could be combined to reveal local file contents by observing outbound requests. SpatialReference now disables network and file access when parsing string input on GDAL 3.9 and later. As a consequence, file paths and URLs are no longer accepted as SpatialReference inputs. Dictionary references using the DICT: prefix, including those prefixed with 'ESRI::', are rejected on all GDAL versions. Full protection requires GDAL 3.9 or later, and a new gis.W001 system check warns when the installed version of GDAL is not at least 3.9. . <https://www.djangoproject.com/weblog/2026/nov/03/security-releases/> . (Closes: #1152952) . python-django (3:5.2.18-2) unstable; urgency=medium . * Adjust the scaling factor in the test for CVE-2025-64460 added in 3:4.2.27-0+deb13u1 as it causes flakiness on loaded machines, and in particular, on the runners for autopkgtests. (Closes: #1126323) . python-django (3:5.2.18-1) unstable; urgency=high . * New upstream security release: . - CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant. This method was subject to a potential denial-of-service attack when processing many distinct and very long language codes. Language codes were used as keys in an in-memory cache before their length was limited, potentially consuming excessive process memory. To mitigate this vulnerability, language codes longer than 500 characters are now rejected or truncated before the cached lookup. . - CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing. django.utils.http.parse_header_parameters() was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this through common headers such as Accept or Content-Type, for instance via the content negotiation performed by HttpRequest.accepts(). The per-call length limit does not bound the combined size of repeated headers. The undocumented django.utils.http.parse_header_parameters() function now uses Python's email.message.Message for parsing. As a result, parsing of some malformed or unusual header values may differ, for example, RFC 2231 values with a missing encoding are now decoded. . - CVE-2026-87890: Potential request forgery via spatial lookup byte values. Spatial lookups accepted raster values provided as bytes without requiring them to be explicitly wrapped in django.contrib.gis.gdal's GDALRaster. Although these values were opened through GDAL's in-memory virtual filesystem, they could contain a VRT document referencing an external raster source. This could cause GDAL to issue network requests as the Django process user while preparing the lookup. This issue could be exploited by applications that passed attacker-controlled bytes directly to a spatial lookup. This was overlooked in the fix for CVE-2026-15307. To mitigate this issue, raster values provided as bytes must now be wrapped in GDALRaster before being used in spatial lookups. Byte values representing valid hexadecimal geometries remain accepted. This is a backward incompatible change. . - CVE-2026-87975: Prevent privilege abuse in model formsets with editable primary keys. Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model's primary key could be set through the form, such as with a OneToOneField (or parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included in the form's fields. Models using the default BigAutoField primary key were not affected. . <https://www.djangoproject.com/weblog/2026/oct/06/security-releases/> . (Closes: #1150176) Checksums-Sha1: 816031a5f87582d5103b5e65d6301ee89f7e2c5d 2824 python-django_5.2.19-1~bpo13+1.dsc ba8f4f4dcbd53c27cc26f38a17d20dfd14ac8a30 10969285 python-django_5.2.19.orig.tar.gz 3abae4cde5e0dfe56d893397a2a814b4ef917b8d 45436 python-django_5.2.19-1~bpo13+1.debian.tar.xz e07313d8c5b8c90c724b2e583a8ac010b07c85bb 3035308 python-django-doc_5.2.19-1~bpo13+1_all.deb d79ecc0212aae962818973a73f0b77df43bb8ab0 8481 python-django_5.2.19-1~bpo13+1_amd64.buildinfo cc29665f9b504874680bc75dd3a48e9882d76790 2905956 python3-django_5.2.19-1~bpo13+1_all.deb Checksums-Sha256: a45a7215ae4b5a9107bb690b495dcadf583e3d4726477b573bed26d2588269e6 2824 python-django_5.2.19-1~bpo13+1.dsc ad03d8abc51dbff95ebf34b27123cf0c26a3b62db7ba0cd520783686362533d1 10969285 python-django_5.2.19.orig.tar.gz 3d3173bd31fd37cfc635f87a524af6050bbabcd3539b3aad70ddb3162a25aeab 45436 python-django_5.2.19-1~bpo13+1.debian.tar.xz 1ffe470a4ba759ca04da18e1bcbd57302026fb9fd9d5a2046f4f4b2fd2f56c70 3035308 python-django-doc_5.2.19-1~bpo13+1_all.deb 1b306b4f98d0029f42977e451ce218bb3d6e021570de6ea09f3f7184d1755733 8481 python-django_5.2.19-1~bpo13+1_amd64.buildinfo 751edf832d3f0b58039519e84ab15a1f74ee3d54c9b9af7c1bd634c7127f2889 2905956 python3-django_5.2.19-1~bpo13+1_all.deb Files: 4337e4ca458efa37695961875be07820 2824 python optional python-django_5.2.19-1~bpo13+1.dsc 48e88356608f080fa460259205e88487 10969285 python optional python-django_5.2.19.orig.tar.gz 33f202173a5d2976740571755a6e47ce 45436 python optional python-django_5.2.19-1~bpo13+1.debian.tar.xz 8fd4e9fb3f57ac7a70fd94e00b4a529c 3035308 doc optional python-django-doc_5.2.19-1~bpo13+1_all.deb 0cb0716b9ef4a553b9084f5d08f65f7d 8481 python optional python-django_5.2.19-1~bpo13+1_amd64.buildinfo 5210816bed2aa4ffc5e30ea43cc45de7 2905956 python optional python3-django_5.2.19-1~bpo13+1_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmrzV6IACgkQHpU+J9Qx Hlg3BxAAkjw3MP+Fz13uoGtkc13iu6b1ZEtkkAhLOIg2lJJcSZFs6wkojsEWYsA7 ShUFqJHo9u8LwYTBz4r610ssF7wvW/CiKgaWyj+RKUgjO/K5DK4J5ZVIGJjxda+6 GX4IlwdMKb/7IIDAjZQmBPvbhQ37IPfAvuDKbkp20PlKbZHunBaPYeu1029wgxFr e3YeSJK4JrigF5Pdm5vsIvKECChdVg0KVFYcRfBWw+E2FA0o+Z/FHgtCHDoi5+47 KTXKCOoanDiphibMEX+pSRKU1AjH6LzGcI9gbx5OdCFH06pbzHfsIknphNRGUfBM rm7iYxDWIR70bWKRULLaNakw4RToXArP5KboIQZ3X2jQriaTpoQsuUmPh371FAQT 7vt3H81Cfk11vPGeB1TFTzzewPWZl80mLXx17L9GBOJ/w9GDRdFAAMuX3i4K2+Qr /OFwzGVwOAOnXBFuulic8MGPgK0MWT9ObkUFZu/9+35GxLeOAKDxO+Q8IjYjh8aJ pSceuhFPfserQV3ACsmGzdHvwZMCRmQnviPULdINLG3JgYhSHVbxU8iYpdlgTMoM 7TxFTB6ni3Ws/yOpeFBUleLraYi9JS9FNAK9f4gTwFVRu5wM34xFeeeiYrdblVrD vPI6H/vuZE2Z3LPsVTw0W8SL3IYOhRwCEvq4wG7DK0XKezER8GI= =PmP6 -----END PGP SIGNATURE-----
