python-django (2:3.2.12-2ubuntu1.27) jammy-security; urgency=medium

  * SECURITY UPDATE: Potential denial-of-service vulnerability in ASGI
    requests via file upload limit bypass
    - debian/patches/CVE-2026-5766.patch: enforce
      DATA_UPLOAD_MAX_MEMORY_SIZE in MemoryFileUploadHandler on ASGI in
      django/core/files/uploadhandler.py, tests/asgi/tests.py,
      tests/requests/tests.py.
    - CVE-2026-5766
  * SECURITY UPDATE: Session fixation via public cached pages and
    SESSION_SAVE_EVERY_REQUEST
    - debian/patches/CVE-2026-35192.patch: ensure Vary header is sent when
      setting session cookie with SESSION_SAVE_EVERY_REQUEST=True in
      django/contrib/sessions/middleware.py, tests/sessions_tests/tests.py.
    - CVE-2026-35192
  * SECURITY UPDATE: Potential exposure of private data due to incorrect
    handling of Vary: * in UpdateCacheMiddleware
    - debian/patches/CVE-2026-6907.patch: prevent caching of requests when
      Vary header contains an asterisk in django/middleware/cache.py,
      tests/cache/tests.py.
    - CVE-2026-6907

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 28 Apr 2026 13:47:40 -0400

python-django (2:3.2.12-2ubuntu1.26) jammy-security; urgency=medium

  * SECURITY UPDATE: Potential denial-of-service vulnerability in
    MultiPartParser via base64-encoded file upload
    - debian/patches/CVE-2026-33033.patch: mitigate potential DoS in
      MultiPartParser in django/http/multipartparser.py,
      tests/requests/tests.py.
    - CVE-2026-33033
  * SECURITY UPDATE: ASGI header spoofing via underscore/hyphen conflation
    - debian/patches/CVE-2026-3902.patch: ignore headers with underscores
      in ASGIRequest in django/core/handlers/asgi.py,
      django/test/client.py, tests/asgi/tests.py.
    - CVE-2026-3902
  * SECURITY UPDATE: Privilege abuse in GenericInlineModelAdmin
    - debian/patches/CVE-2026-4277.patch: Check add permissions in
      GenericInlineModelAdmin in django/contrib/contenttypes/admin.py,
      tests/generic_inline_admin/tests.py.
    - CVE-2026-4277
  * SECURITY UPDATE: Privilege abuse in ModelAdmin.list_editable
    - debian/patches/CVE-2026-4292.patch: Disallow instance creation via
      ModelAdmin.list_editable in django/contrib/admin/options.py,
      tests/admin_views/admin.py, tests/admin_views/tests.py.
    - CVE-2026-4292

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Apr 2026 10:58:20 -0400

python-django (2:3.2.12-2ubuntu1.25) jammy-security; urgency=medium

  * SECURITY UPDATE: Username enumeration through timing difference in
    mod_wsgi authentication handler
    - debian/patches/CVE-2025-13473.patch: standardize timing of
      check_password() in mod_wsgi auth handler in
      django/contrib/auth/handlers/modwsgi.py,
      tests/auth_tests/test_handlers.py.
    - CVE-2025-13473
  * SECURITY UPDATE: Potential denial-of-service vulnerability via repeated
    headers when using ASGI
    - debian/patches/CVE-2025-14550.patch: optimize repeated header parsing
      in ASGI requests in django/core/handlers/asgi.py,
      tests/asgi/tests.py.
    - CVE-2025-14550
  * SECURITY UPDATE: Potential SQL injection via raster lookups on PostGIS
    - debian/patches/CVE-2026-1207.patch: prevent SQL injections in
      RasterField lookups via band index in
      django/contrib/gis/db/backends/postgis/operations.py,
      tests/gis_tests/rasterapp/test_rasterfield.py.
    - CVE-2026-1207
  * SECURITY UPDATE: Potential denial-of-service vulnerability in
    django.utils.text.Truncator HTML methods
    - debian/patches/CVE-2026-1285.patch: mitigate potential DoS in
      django.utils.text.Truncator for HTML input in django/utils/text.py,
      tests/utils_tests/test_text.py.
    - CVE-2026-1285
  * SECURITY UPDATE: Potential SQL injection in column aliases via control
    characters
    - debian/patches/CVE-2026-1287.patch: protect against SQL injection in
      column aliases via control characters in
      django/db/models/sql/query.py, tests/aggregation/tests.py,
      tests/annotations/tests.py, tests/queries/tests.py,
      tests/expressions/test_queryset_values.py.
    - CVE-2026-1287

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 28 Jan 2026 08:16:57 -0500

python-django (2:3.2.12-2ubuntu1.24) jammy-security; urgency=medium

  * SECURITY UPDATE: SQL injection in FilteredRelation column aliases on
    PostgreSQL
    - debian/patches/CVE-2025-13372.patch: protect FilteredRelation against
      SQL injection in column aliases in
      django/db/backends/postgresql/compiler.py,
      django/db/backends/postgresql/operations.py,
      tests/annotations/tests.py.
    - CVE-2025-13372
  * SECURITY UPDATE: DoS vulnerability in XML serializer text extraction
    - debian/patches/CVE-2025-64460.patch: corrected quadratic inner text
      accumulation in XML serializer in
      django/core/serializers/xml_serializer.py,
      docs/topics/serialization.txt,
      tests/serializers/test_xml.py.
    - CVE-2025-64460

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 26 Nov 2025 11:43:28 -0500

python-django (2:3.2.12-2ubuntu1.23) jammy-security; urgency=medium

  * SECURITY UPDATE: Potential SQL injection in QuerySet and Q objects
    - debian/patches/CVE-2025-62769-1.patch: Add connects and checks for them
      in django/db/models/query_utils.py.
    - debian/patches/CVE-2025-62769-2.patch: Add PROHIBITED_FILTER_KWARGS and
      check for them in django/db/models/query.py.
    - CVE-2025-62769

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 30 Oct 2025 11:56:36 -0230

python-django (2:3.2.12-2ubuntu1.22) jammy-security; urgency=medium

  * SECURITY UPDATE: Potential SQL injection
    - debian/patches/CVE-2025-59681.patch: protect against SQL injection in
      django/db/models/sql/query.py, tests/aggregation/tests.py,
      tests/annotations/tests.py,
      tests/expressions/test_queryset_values.py, tests/queries/tests.py.
    - CVE-2025-59681
  * SECURITY UPDATE: Potential partial directory-traversal
    - debian/patches/CVE-2025-59682.patch: validate path in
      django/utils/archive.py, tests/utils_tests/test_archive.py.
    - CVE-2025-59682

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 24 Sep 2025 12:28:31 -0400

python-django (2:3.2.12-2ubuntu1.21) jammy-security; urgency=medium

  * SECURITY UPDATE: SQL injection
    - debian/patches/CVE-2025-57833.patch: protected
      FilteredRelation against SQL injection in column
      aliases in django/db/models/sql/query.py,
      tests/annotations/tests.py.
    - debian/patches/skipping_tests.patch: skipping
      FTBFS tests test_strip_tags.
    - CVE-2025-57833

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 01 Sep 2025 13:01:20 -0300

python-django (2:3.2.12-2ubuntu1.20) jammy-security; urgency=medium

  * SECURITY UPDATE: Prevented log injection
    - debian/patches/CVE-2025-48432-2.patch: prevented log injection in
      remaining response logging in django/views/generic/base.py,
      test/generic_views/test_base.py (LP: #2113924)

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Wed, 11 Jun 2025 16:31:28 -0300

python-django (2:3.2.12-2ubuntu1.19) jammy-security; urgency=medium

  * SECURITY UPDATE: Log structure manipulation
    - debian/patches/CVE-2025-48432.patch: escape formatting
      arguments in log_response() in django/utils/log.py,
      tests/logging_tests/tests.py.
    - CVE-2025-48432

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 02 Jun 2025 08:11:47 -0300

python-django (2:3.2.12-2ubuntu1.18) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service in strip_tags()
    - debian/patches/CVE-2025-32873.patch: check tag depth in
      django/utils/html.py, tests/utils_tests/test_html.py.
    - CVE-2025-32873

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 30 Apr 2025 10:34:27 -0400

# For older changelog entries, run 'apt-get changelog python-django-doc'
