All errata/p10/ALT-PU-2026-8452-2
ALT-PU-2026-8452-2

Package update python3-module-django in branch p10

Version3.2.25-alt2
Task#419378
Published2026-05-28
Max severityHIGH
Severity:

Closed issues (6)

BDU:2026-03466
MEDIUM5.4

Уязвимость программной платформы для веб-приложений Django, связанная с непринятием мер по защите структуры запроса SQL, позволяющая нарушителю выполнить произвольный код

Published: 2026-03-22Modified: 2026-04-26
CVSS 3.xMEDIUM 5.4
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0MEDIUM 5.5
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:N
References
BDU:2026-05927
MEDIUM6.5

Уязвимость функции MultiPartParser() программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-04-27Modified: 2026-05-27
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C
References
CVE-2026-1207
MEDIUM5.4

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

Published: 2026-02-03Modified: 2026-06-17
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
CVE-2026-33033
MEDIUM6.5

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Published: 2026-04-07Modified: 2026-06-17
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
GHSA-5mf9-h53q-7mhq
MEDIUM6.5

Django has potential DoS via MultiPartParser through crafted multipart uploads

Published: 2026-04-07Modified: 2026-06-05
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
GHSA-mwm9-4648-f68q
HIGH8.1

Django has an SQL Injection issue

Published: 2026-02-03Modified: 2026-06-05
CVSS 4.0HIGH 8.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
References