Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas Perale via buildroot <buildroot@buildroot.org>
To: buildroot@buildroot.org
Cc: "Manuel Diener" <manuel.diener@oss.othermo.de>,
	"Raphaël Mélotte" <raphael.melotte@mind.be>,
	"Thomas Perale" <thomas.perale@mind.be>,
	"James Hilliard" <james.hilliard1@gmail.com>,
	"Oli Vogt" <oli.vogt.pub01@gmail.com>,
	"Marcus Hoffmann" <bubu@bubu1.eu>
Subject: [Buildroot] [PATCH 2025.02.x 2/2] package/python-django: security bump to version 5.2.19
Date: Mon,  9 Nov 2026 17:19:49 +0100	[thread overview]
Message-ID: <20261109161949.714131-2-thomas.perale@mind.be> (raw)
In-Reply-To: <20261109161949.714131-1-thomas.perale@mind.be>

Fixes the following security issues:

- CVE-2026-108147: memory exhaustion via base64-encoded file uploads.
- CVE-2026-111211: log injection through geometry form values.
- CVE-2026-111362: SSRF through GeoJSON coordinate system references.
- CVE-2026-113593: private data exposure through cached Vary headers.
- CVE-2026-114582: SSRF through SpatialReference string input.

https://docs.djangoproject.com/en/5.2/releases/5.2.19/

(alternative to commit 5b5c1c9b6b4086a405a5a2a8f3aa64e018e3697c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/python-django/python-django.hash | 4 ++--
 package/python-django/python-django.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/python-django/python-django.hash b/package/python-django/python-django.hash
index 9bb445877f..30676ddc60 100644
--- a/package/python-django/python-django.hash
+++ b/package/python-django/python-django.hash
@@ -1,6 +1,6 @@
 # md5, sha256 from https://pypi.org/pypi/django/json
-md5  37d9504be21272595b91c2aa3ef4904c  django-5.2.18.tar.gz
-sha256  461c5dd06d2ea16bd5ca37d3f46e4def1d6b0fe7588c6f4e2119517bb0af8b2d  django-5.2.18.tar.gz
+md5  48e88356608f080fa460259205e88487  django-5.2.19.tar.gz
+sha256  ad03d8abc51dbff95ebf34b27123cf0c26a3b62db7ba0cd520783686362533d1  django-5.2.19.tar.gz
 # Locally computed sha256 checksums
 sha256  b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669  LICENSE
 sha256  a6fa72074c31928128aaa18162204507938b7a9a8b819bd833fa82467441800d  django/contrib/gis/measure.py
diff --git a/package/python-django/python-django.mk b/package/python-django/python-django.mk
index a94853c518..d36c6b82ce 100644
--- a/package/python-django/python-django.mk
+++ b/package/python-django/python-django.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-PYTHON_DJANGO_VERSION = 5.2.18
+PYTHON_DJANGO_VERSION = 5.2.19
 PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz
 # The official Django site has an unpractical URL
 PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/source/d/django
-- 
2.56.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

      reply	other threads:[~2026-11-09 16:20 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-09 16:19 [Buildroot] [PATCH 2025.02.x 1/2] package/python-django: fix build with older setuptools Thomas Perale via buildroot
2026-11-09 16:19 ` Thomas Perale via buildroot [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261109161949.714131-2-thomas.perale@mind.be \
    --to=buildroot@buildroot.org \
    --cc=bubu@bubu1.eu \
    --cc=james.hilliard1@gmail.com \
    --cc=manuel.diener@oss.othermo.de \
    --cc=oli.vogt.pub01@gmail.com \
    --cc=raphael.melotte@mind.be \
    --cc=thomas.perale@mind.be \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox