Accepted python-django 3:6.0.5-1 (source) into experimental

Debian FTP Masters Tue, 05 May 2026 09:50:28 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 05 May 2026 08:03:16 -0700
Source: python-django
Built-For-Profiles: nocheck
Architecture: source
Version: 3:6.0.5-1
Distribution: experimental
Urgency: high
Maintainer: Debian Python Team <[email protected]>
Changed-By: Chris Lamb <[email protected]>
Closes: 1135755
Changes:
 python-django (3:6.0.5-1) experimental; urgency=high
 .
   * New upstream security release:
 .
     - CVE-2026-5766: Prevent a potential denial-of-service vulnerability in
       ASGI requests via a file upload limit bypass. ASGI requests with a
       missing or understated Content-Length header could bypass the
       FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
       memory and causing service degradation. As a reminder, Django expects a
       limit to be configured at the web server level rather than solely relying
       on FILE_UPLOAD_MAX_MEMORY_SIZE.
 .
     - CVE-2026-35192: Address a session fixation issue via public cached pages
       and SESSION_SAVE_EVERY_REQUEST. Response headers did not vary on cookies
       if a session was not modified but SESSION_SAVE_EVERY_REQUEST was True. A
       remote attacker could therefore steal a user's session after that user
       visits a cached public page.
 .
     - CVE-2026-6907: Prevent a potential exposure of private data due to 
incorrect
       handling of "Vary: *" in UpdateCacheMiddleware. Previously,
       django.middleware.cache.UpdateCacheMiddleware would erroneously cache
       requests where the Vary header contained an asterisk ('*'). This could
       lead to private data being stored and served.
 .
     (Closes: #1135755)
 .
   * Bump Standards-Version to 4.7.4.
Checksums-Sha1:
 043c11cfc0fce20bb61de3468d6093955b958ce7 2783 python-django_6.0.5-1.dsc
 b9f5649872874dd17cf1c9d7cc25617cb23c5b7c 10924131 
python-django_6.0.5.orig.tar.gz
 a485087ffbc602c8d9622dc4ae71a32e830a77d8 32564 
python-django_6.0.5-1.debian.tar.xz
 de6e7b5695af6bc843a776929c6332054c59bee1 8227 
python-django_6.0.5-1_amd64.buildinfo
Checksums-Sha256:
 86550e52d69e3a46f04c1c4b4b96b6b68f295061ee486432ec9479ac8a52ad1d 2783 
python-django_6.0.5-1.dsc
 bc6d6872e98a2864c836e42edd644b362db311147dd5aa8d5b82ba7a032f5269 10924131 
python-django_6.0.5.orig.tar.gz
 e22b9310019e71a79dbbd99bb2f4a246bafa64376461d752e9df07539c1623ce 32564 
python-django_6.0.5-1.debian.tar.xz
 9222ac9c24c375c0b87ffa528705a5fc1e80cc87896fd22ac032721fd963fa25 8227 
python-django_6.0.5-1_amd64.buildinfo
Files:
 f4b5d6158f823c8fb374578ed01d4a60 2783 python optional python-django_6.0.5-1.dsc
 44c18a8f264c1326e6fe4f1053fea5fc 10924131 python optional 
python-django_6.0.5.orig.tar.gz
 c40740e19763dfc64b246607bf9c7fc5 32564 python optional 
python-django_6.0.5-1.debian.tar.xz
 167bdb4e05103c9d3e363f147087d33b 8227 python optional 
python-django_6.0.5-1_amd64.buildinfo
pgp2mv5SuPi4A.pgp
Description: PGP signature
Accepted python-django 3:6.0.5-1 (source) into experimental

Reply via email to
