< back to search

gpp_maybe Security update for python3-django
openSUSE-2026-290

This update for python3-Django fixes the following issues: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups (boo#1272997) - CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (boo#1272998) - CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (boo#1272999) - CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (boo#1273000) - CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response (boo#1271029) - CVE-2026-53877: Heap buffer over-read in GDALRaster (boo#1271030) - CVE-2026-6873: Signed cookie salt namespace collision (boo#1267578) - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend (boo#1267579) - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives (boo#1267580) - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization (boo#1267576) - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header (boo#1267577) - CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (boo#1264153) - CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST (boo#1264154) - CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware (boo#1264152) - CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin (boo#1261731) - CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable (boo#1261732) - CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload (boo#1261722) - CVE-2026-25674: python-Django: race condition can lead to potential incorrect permissions on newly created file system objects (boo#1259142) - CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation (boo#1257408) - CVE-2026-1287: Potential SQL injection in column aliases via control characters (boo#1257407) - CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS (boo#1257405) - CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler (boo#1257401) - CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods (boo#1257406) - CVE-2025-13372, CVE-2025-64460: Denial of service in django.core.serializers.xml_serializer.getInnerText() (boo#1254437) - CVE-2025-64459: Potential SQL injection via `_connector` keyword argument in `QuerySet` and `Q` objects (boo#1252926) - CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (boo#1250485) - CVE-2025-59682: Potential partial directory-traversal via archive.extract() (boo#1250487) - CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases (boo#1248810) - CVE-2025-48432: potential log injection via unescaped request path (boo#1244095) - Let django-admin be the master alternative * django-admin.py was dropped in newer releases of Django * uninstall the alternatives in postun as is standard in SUSE

cloud_download Downloads

SUSE Package Hub 15.7 ppc64le
  • Packages
    python3-Django
    A high-level Python Web framework
    2.2.28-bp157.2.3.1 lock rpm
SUSE Package Hub 15.7 aarch64
  • Packages
    python3-Django
    A high-level Python Web framework
    2.2.28-bp157.2.3.1 lock rpm
SUSE Package Hub 15.7 s390x
  • Packages
    python3-Django
    A high-level Python Web framework
    2.2.28-bp157.2.3.1 lock rpm
SUSE Package Hub 15.7 x86_64
  • Packages
    python3-Django
    A high-level Python Web framework
    2.2.28-bp157.2.3.1 lock rpm