Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
655c4435 by Salvatore Bonaccorso at 2026-02-03T20:59:37+01:00
Add upstream commit references for python-django issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,21 +1,27 @@
CVE-2026-1312 [Potential SQL injection via QuerySet.order_by and
FilteredRelation]
- python-django <unfixed>
NOTE:
https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+ NOTE: Fixed by:
https://github.com/django/django/commit/90f5b10784ba5bf369caed87640e2b4394ea3314
(4.2.28)
CVE-2026-1287 [Potential SQL injection in column aliases via control
characters]
- python-django <unfixed>
NOTE:
https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+ NOTE: Fixed by:
https://github.com/django/django/commit/f75f8f3597e1ce351d5ac08b6ba7ebd9dadd9b5d
(4.2.28)
CVE-2026-1285 [Potential denial-of-service vulnerability in
django.utils.text.Truncator HTML methods]
- python-django <unfixed>
NOTE:
https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+ NOTE: Fixed by:
https://github.com/django/django/commit/b40cfc6052ced26dcd8166a58ea6f841d0d2cac8
(4.2.28)
CVE-2026-1207 [Potential SQL injection via raster lookups on PostGIS]
- python-django <unfixed>
NOTE:
https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+ NOTE: Fixed by:
https://github.com/django/django/commit/a14363102d98fa29b8cced578eb3a0fadaa5bcb7
(4.2.28)
CVE-2025-14550 [Potential denial-of-service vulnerability via repeated headers
when using ASGI]
- python-django <unfixed>
NOTE:
https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+ NOTE: Fixed by:
https://github.com/django/django/commit/f578acc8c54530fffabd52d2db654c8669b011af
(4.2.28)
CVE-2025-13473 [Username enumeration through timing difference in mod_wsgi
authentication handler]
- python-django <unfixed>
NOTE:
https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+ NOTE: Fixed by:
https://github.com/django/django/commit/6dc23508f3395e1254c315084c7334ef81c4c09a
(4.2.28)
CVE-2026-25228 (Signal K Server is a server application that runs on a central
hub in ...)
NOT-FOR-US: Signal K Server
CVE-2026-25222 (PolarLearn is a free and open-source learning program. In
0-PRERELEASE ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/655c443503ff246201d603180e4d15d68d2bb66a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/655c443503ff246201d603180e4d15d68d2bb66a
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
