Source: python-django Version: 3:4.2.25-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Control: found -1 3:4.2.23-1
Hi, The following vulnerabilities were published for python-django. CVE-2025-64458[0]: | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and | 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. | As a consequence, `django.http.HttpResponseRedirect`, | `django.http.HttpResponsePermanentRedirect`, and the shortcut | `django.shortcuts.redirect` were subject to a potential denial-of- | service attack via certain inputs with a very large number of | Unicode characters. Earlier, unsupported Django series (such as | 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be | affected. Django would like to thank Seokchan Yoon for reporting | this issue. CVE-2025-64459[1]: | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and | 5.2 before 5.2.8. The methods `QuerySet.filter()`, | `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are | subject to SQL injection when using a suitably crafted dictionary, | with dictionary expansion, as the `_connector` argument. Earlier, | unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not | evaluated and may also be affected. Django would like to thank | cyberstan for reporting this issue. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-64458 https://www.cve.org/CVERecord?id=CVE-2025-64458 [1] https://security-tracker.debian.org/tracker/CVE-2025-64459 https://www.cve.org/CVERecord?id=CVE-2025-64459 [2] https://www.djangoproject.com/weblog/2025/nov/05/security-releases/ Please adjust the affected versions in the BTS as needed. Regards, Salvatore
