critical Security update for python-django

SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-3446

This update for python-Django fixes the following issues: - CVE-2025-59681: SQL injection via the `QuerySet` annotate()`, `alias()`, `aggregate()`, or `extra()` methods when processing a specially crafted dictionary with dictionary expansion (bsc#1250485). - CVE-2025-59682: directory traversal via the `django.utils.archive.extract()` function when processing an archive with file paths that share a common prefix with the target directory (bsc#1250487).

• Release Date
  Oct 2 2025
• References
  Bugzilla: 1250485, 1250487
  CVEs: CVE-2025-59681, CVE-2025-59682
• Type
  security
• Severity
  critical

cloud_download Downloads

SUSE Package Hub 15.7 ppc64le

• Packages
  python-Django
  A high-level Python Web framework

  4.2.11-150600.3.33.1 lock src

  python311-Django
  A high-level Python Web framework

  4.2.11-150600.3.33.1 lock rpm

SUSE Package Hub 15.7 aarch64

• Packages
  python-Django
  A high-level Python Web framework

  4.2.11-150600.3.33.1 lock src

  python311-Django
  A high-level Python Web framework

  4.2.11-150600.3.33.1 lock rpm

SUSE Package Hub 15.7 s390x

• Packages
  python-Django
  A high-level Python Web framework

  4.2.11-150600.3.33.1 lock src

  python311-Django
  A high-level Python Web framework

  4.2.11-150600.3.33.1 lock rpm

SUSE Package Hub 15.7 x86_64

• Packages
  python-Django
  A high-level Python Web framework

  4.2.11-150600.3.33.1 lock src

  python311-Django
  A high-level Python Web framework

  4.2.11-150600.3.33.1 lock rpm