ALT-PU-2025-7989-1
Package python3-module-django updated to version 5.2.2-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Published: 2025-06-04
BDU:2025-06450
Уязвимость функции django.utils.log.log_response() программной платформы для веб-приложений Django, позволяющая нарушителю получить доступ на изменение данных в журнале
Severity: MEDIUM (4.0)
Vector: AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Severity: LOW (2.6)
Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
References:
Published: 2025-06-05
Modified: 2025-06-10
Modified: 2025-06-10
CVE-2025-48432
An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
Severity: MEDIUM (4.0)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
References:
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
- https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/
- http://www.openwall.com/lists/oss-security/2025/06/04/5
- http://www.openwall.com/lists/oss-security/2025/06/10/2
- http://www.openwall.com/lists/oss-security/2025/06/10/3
- http://www.openwall.com/lists/oss-security/2025/06/10/4