Accepted python-django 3:6.1.3-1 (source) into experimental

Debian FTP Masters Tue, 03 Nov 2026 13:01:19 -0800
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 12:34:24 -0800
Source: python-django
Built-For-Profiles: nocheck
Architecture: source
Version: 3:6.1.3-1
Distribution: experimental
Urgency: high
Maintainer: Debian Python Team <[email protected]>
Changed-By: Chris Lamb <[email protected]>
Changes:
 python-django (3:6.1.3-1) experimental; urgency=high
 .
   * New upstream security release:
 .
     - CVE-2026-108147: Prevent a potential memory exhaustion in MultiPartParser
       via base64-encoded file uploads. When using django.http.multipartparser's
       MultiPartParser, multipart uploads with a "Content-Transfer-Encoding:
       base64" header could be buffered entirely in memory regardless of the
       value of FILE_UPLOAD_MAX_MEMORY_SIZE before being passed to upload
       handlers, potentially consuming excessive memory.
 .
     - CVE-2026-111211: Avoid a potential log injection via unescaped geometry
       form values. django.contrib.gis.forms.GeometryField (and its widgets)
       logged invalid submitted values directly, allowing control characters
       (e.g. newlines or ANSI escape sequences) to be written unescaped into
       logs. This could have enabled log injection or forgery, letting attackers
       manipulate log appearances and structures, especially in logs processed
       by external systems or when viewed in terminals.
 .
     - CVE-2026-111362: Fix a server-side request forgery via the 'crs' member
       of GeoJSON geometries. Earlier versions of the GeoJSON spec allowed
       specifying a coordinate reference system (CRS) by URL. Since GDAL still
       resolves these URLs, any validation, save or query path where a geometry
       is instantiated from user input allowed an attacker to submit a malicious
       CRS that would make a network request as the Django process user or read
       a file (or both). Lookups against spatial fields, the GeometryField form
       field and GEOSGeometry now reject GeoJSON geometries with CRS references
       to external resources. The DataSource and LayerMapping utilities for
       loading trusted data continue to accept these values, however.
 .
     - CVE-2026-113593: Avoid a potential exposure of private data via empty and
       missing 'Vary' headers. UpdateCacheMiddleware and cache_page() generated
       the same cache key for a request that omitted a header listed in the
       response's 'Vary' header and a request that sent that header with an
       empty value. As a result, a response cached for one of these requests
       could be served to the other which could lead to the exposure of private
       data. Cache keys now distinguish between absent and empty header values
       as required by RFC 9111#section-4.1. Responses previously cached for
       requests that omitted a header listed in 'Vary' will no longer be
       matched and will be cached again on the next request.
 .
     - CVE-2026-113733: Fix a password hash disclosure to "view only" admin
       users with custom user models. Admin users with the 'view' (but not
       'change') permission to a user model were shown the entire password hash
       when the model was not AUTH_USER_MODEL (or when AUTH_USER_MODEL inherited
       its password field from a concrete parent model through multi-table
       inheritance).
 .
     - CVE-2026-114582: Avoid a server-side request forgery via SpatialReference
       string input. SpatialReference passed string input to GDAL, which by
       default resolves URLs and reads files. This behavior was not previously
       documented by Django. (Other affected methods included
       GEOSGeometry.transform, OGRGeometry.transform, GDALRaster.transform, the
       srs setter of OGRGeometry and the srs and srid setters of GDALRaster.) A
       URL or file path reaching any of these would issue an outbound request or
       read a file as the Django process user. The attack vectors could be
       combined to reveal local file contents by observing outbound requests.
       SpatialReference now disables network and file access when parsing string
       input on GDAL 3.9 and later. As a consequence, file paths and URLs are no
       longer accepted as SpatialReference inputs. Dictionary references using
       the DICT: prefix, including those prefixed with 'ESRI::', are rejected on
       all GDAL versions. Full protection requires GDAL 3.9 or later, and a new
       gis.W001 system check warns when the installed version of GDAL is not at
       least 3.9.
 .
     For more information, please see:
 .
       <https://www.djangoproject.com/weblog/2026/nov/03/security-releases/>
Checksums-Sha1:
 1f931ec082d46687b9a2c7272c5cbda99005ba83 2783 python-django_6.1.3-1.dsc
 9f7a2ed8606fec0f64732a55afe682b6a1c38036 11306257 
python-django_6.1.3.orig.tar.gz
 abda8cdacfcb4f0e47154abb21179f0c35fb21ed 35404 
python-django_6.1.3-1.debian.tar.xz
 ff28ff041693287f3e5ebbfff1313e8a2db30dd1 7797 
python-django_6.1.3-1_amd64.buildinfo
Checksums-Sha256:
 0536d41a912ff8f715244c568efb3a1cefc1f40d0a3e37d0a051643b1c0b974b 2783 
python-django_6.1.3-1.dsc
 b5d2d9e35295065d13b1927b3f19a59bd119f737aa6299def14ccca1ae3c8c0d 11306257 
python-django_6.1.3.orig.tar.gz
 568ebb06507a8349aac8b5a6ab9f69b066c352f4c3a4eeee02d7b319e1f1622a 35404 
python-django_6.1.3-1.debian.tar.xz
 22f0e568dbe28189c2b7ebb1c1320ebaeef2400db6422a1db7a8bf0d429ec096 7797 
python-django_6.1.3-1_amd64.buildinfo
Files:
 4acfd7b1fb5f47cedcaed0ace3849db5 2783 python optional python-django_6.1.3-1.dsc
 3cb5521afc0cd034743c7c258d3cb85f 11306257 python optional 
python-django_6.1.3.orig.tar.gz
 922abc1309594c0cdf6fbd4e1b83984a 35404 python optional 
python-django_6.1.3-1.debian.tar.xz
 bb365582acb6b98e09385d6fa131e9d1 7797 python optional 
python-django_6.1.3-1_amd64.buildinfo
pgpYn5X308B27.pgp
Description: PGP signature
Accepted python-django 3:6.1.3-1 (source) into experimental

Reply via email to
