python-django (3:5.2.9-0ubuntu4.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Potential denial-of-service vulnerability in ASGI
    requests via file upload limit bypass
    - debian/patches/CVE-2026-5766.patch: enforce
      DATA_UPLOAD_MAX_MEMORY_SIZE in MemoryFileUploadHandler on ASGI in
      django/core/files/uploadhandler.py, tests/asgi/tests.py,
      tests/requests_tests/tests.py.
    - CVE-2026-5766
  * SECURITY UPDATE: Session fixation via public cached pages and
    SESSION_SAVE_EVERY_REQUEST
    - debian/patches/CVE-2026-35192.patch: ensure Vary header is sent when
      setting session cookie with SESSION_SAVE_EVERY_REQUEST=True in
      django/contrib/sessions/middleware.py, tests/sessions_tests/tests.py.
    - CVE-2026-35192
  * SECURITY UPDATE: Potential exposure of private data due to incorrect
    handling of Vary: * in UpdateCacheMiddleware
    - debian/patches/CVE-2026-6907.patch: prevent caching of requests when
      Vary header contains an asterisk in django/middleware/cache.py,
      tests/cache/tests.py.
    - CVE-2026-6907

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 28 Apr 2026 13:35:31 -0400

python-django (3:5.2.9-0ubuntu4) resolute; urgency=medium

  * SECURITY UPDATE: Potential denial-of-service vulnerability in
    MultiPartParser via base64-encoded file upload
    - debian/patches/CVE-2026-33033.patch: mitigate potential DoS in
      MultiPartParser in django/http/multipartparser.py,
      tests/requests_tests/tests.py.
    - CVE-2026-33033
  * SECURITY UPDATE: Potential denial-of-service vulnerability in ASGI
    requests via memory upload limit bypass
    - debian/patches/CVE-2026-33034.patch: enforce
      DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ASGI requests in
      django/http/request.py, tests/asgi/tests.py.
    - CVE-2026-33034
  * SECURITY UPDATE: ASGI header spoofing via underscore/hyphen conflation
    - debian/patches/CVE-2026-3902.patch: ignore headers with underscores
      in ASGIRequest in django/core/handlers/asgi.py,
      django/test/client.py, tests/asgi/tests.py.
    - CVE-2026-3902
  * SECURITY UPDATE: Privilege abuse in GenericInlineModelAdmin
    - debian/patches/CVE-2026-4277.patch: Check add permissions in
      GenericInlineModelAdmin in django/contrib/contenttypes/admin.py,
      tests/generic_inline_admin/tests.py.
    - CVE-2026-4277
  * SECURITY UPDATE: Privilege abuse in ModelAdmin.list_editable
    - debian/patches/CVE-2026-4292.patch: Disallow instance creation via
      ModelAdmin.list_editable in django/contrib/admin/options.py,
      tests/admin_views/admin.py, tests/admin_views/tests.py.
    - CVE-2026-4292

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Apr 2026 09:17:54 -0400

python-django (3:5.2.9-0ubuntu3) resolute; urgency=medium

  * SECURITY UPDATE: Username enumeration through timing difference in
    mod_wsgi authentication handler
    - debian/patches/CVE-2025-13473.patch: standardize timing of
      check_password() in mod_wsgi auth handler in
      django/contrib/auth/handlers/modwsgi.py,
      tests/auth_tests/test_handlers.py.
    - CVE-2025-13473
  * SECURITY UPDATE: Potential denial-of-service vulnerability via repeated
    headers when using ASGI
    - debian/patches/CVE-2025-14550.patch: optimize repeated header parsing
      in ASGI requests in django/core/handlers/asgi.py,
      tests/asgi/tests.py.
    - CVE-2025-14550
  * SECURITY UPDATE: Potential SQL injection via raster lookups on PostGIS
    - debian/patches/CVE-2026-1207.patch: prevent SQL injections in
      RasterField lookups via band index in
      django/contrib/gis/db/backends/postgis/operations.py,
      tests/gis_tests/rasterapp/test_rasterfield.py.
    - CVE-2026-1207
  * SECURITY UPDATE: Potential denial-of-service vulnerability in
    django.utils.text.Truncator HTML methods
    - debian/patches/CVE-2026-1285.patch: mitigate potential DoS in
      django.utils.text.Truncator for HTML input in django/utils/text.py,
      tests/utils_tests/test_text.py.
    - CVE-2026-1285
  * SECURITY UPDATE: Potential SQL injection in column aliases via control
    characters
    - debian/patches/CVE-2026-1287.patch: protect against SQL injection in
      column aliases via control characters in
      django/db/models/sql/query.py, tests/aggregation/tests.py,
      tests/annotations/tests.py, tests/queries/tests.py,
      tests/expressions/test_queryset_values.py.
    - CVE-2026-1287
  * SECURITY UPDATE: Potential SQL injection via QuerySet.order_by and
    FilteredRelation
    - debian/patches/CVE-2026-1312-1.patch: protect order_by() from SQL
      injection via aliases with periods in
      django/db/models/sql/compiler.py, tests/ordering/tests.py.
    - debian/patches/CVE-2026-1312-2.patch: raise ValueError when
      FilteredRelation aliases contain periods in
      django/db/models/sql/query.py, tests/filtered_relation/tests.py,
      tests/ordering/tests.py.
    - CVE-2026-1312

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 04 Feb 2026 13:38:58 -0500

python-django (3:5.2.9-0ubuntu2) resolute; urgency=medium

  * d/p/pgsql18-not-null-constraints.patch: Skip NOT NULL constraints on
    PostgreSQL 18 (LP: #2136172)

 -- Athos Ribeiro <athos@ubuntu.com>  Mon, 15 Dec 2025 15:24:04 -0300

python-django (3:5.2.9-0ubuntu1) resolute; urgency=medium

  * Updated to 5.2.9 to fix security issues.
    - CVE-2025-13372
    - CVE-2025-64460
  * debian/patches/fix-new-python.patch: fix FTBFS with newer Python.
  * Dropped patches no longer needed with 5.2.9
    - CVE-2025-57833.patch
    - fixing_test_strip_tags.patch
    - fixing_test_parsing_errors.patch
    - CVE-2025-59681.patch
    - CVE-2025-59682.patch
    - CVE-2025-64459-1.patch
    - CVE-2025-64459-2.patch
    - FTBFS-test_pickle_errors_detection.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 10 Dec 2025 07:54:27 -0500

python-django (3:5.2.4-1ubuntu3) resolute; urgency=medium

  * SECURITY UPDATE: Potential SQL injection in QuerySet and Q objects
    - debian/patches/CVE-2025-64459-1.patch: Add connects and checks for them
      in django/db/models/query_utils.py.
    - debian/patches/CVE-2025-64459-2.patch: Add PROHIBITED_FILTER_KWARGS and
      check for them in django/db/models/query.py.
    - CVE-2025-64459
  * FTBFS-test_pickle_errors_detection.patch: Fix FTBFS in
    test_pickle_errors_detection test function in
    tests/test_runner/test_parallel.py

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 06 Nov 2025 09:58:31 +0100

python-django (3:5.2.4-1ubuntu2) questing; urgency=medium

  * SECURITY UPDATE: Potential SQL injection
    - debian/patches/CVE-2025-59681.patch: protect against SQL injection in
      django/db/models/sql/query.py, tests/aggregation/tests.py,
      tests/annotations/tests.py,
      tests/expressions/test_queryset_values.py, tests/queries/tests.py.
    - CVE-2025-59681
  * SECURITY UPDATE: Potential partial directory-traversal
    - debian/patches/CVE-2025-59682.patch: validate path in
      django/utils/archive.py, tests/utils_tests/test_archive.py.
    - CVE-2025-59682

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Oct 2025 12:49:58 -0400

python-django (3:5.2.4-1ubuntu1) questing; urgency=medium

  * SECURITY UPDATE: SQL injection
    - debian/patches/CVE-2025-57833.patch: protected
      FilteredRelation against SQL injection in column
      aliases in django/db/models/sql/query.py,
      tests/annotations/tests.py.
    - debian/patches/fixing_test_stip_tags.patch: Adjusted
      utils_tests.test_html.TestUtilsHtml.test_strip_tags following Python's
      HTMLParser new behavior in tests/utils_test/test_html.py.
    - debian/patches/fixing_test_parsing_errors.patch: Fixed
      test_utils.tests.HTMLEqualTests.test_parsing_errors
      following Python's HTMLParser fixed parsing in
      tests/test_utils/tests.py.
    - CVE-2025-57833

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 15 Sep 2025 09:13:25 -0300

python-django (3:5.2.4-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://www.djangoproject.com/weblog/2025/jul/02/bugfix-releases/>

 -- Chris Lamb <lamby@debian.org>  Mon, 07 Jul 2025 10:29:43 -0700

python-django (3:5.2.3-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/>

 -- Chris Lamb <lamby@debian.org>  Tue, 10 Jun 2025 08:53:25 -0700

python-django (3:5.2.2-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2025-48432: Potential log injection via unescaped request path.

      Django's internal HTTP response logging used request.path directly,
      allowing control characters (e.g. newlines or ANSI escape sequences) to
      be written unescaped into logs. This could enable log injection or
      forgery, letting attackers manipulate log appearance or structure,
      especially in logs processed by external systems or viewed in terminals.

      Although this does not directly impact Django's security model, it poses
      risks when logs are consumed or interpreted by other tools.  To fix this,
      the internal django.utils.log.log_response() function now escapes all
      positional formatting arguments using a safe encoding.

      (Closes: #1107282)

    <https://www.djangoproject.com/weblog/2025/jun/04/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 04 Jun 2025 08:09:36 -0700

python-django (3:5.2.1-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2025-32873: Denial-of-service possibility in strip_tags()

      django.utils.html.strip_tags() would be slow to evaluate certain inputs
      containing large sequences of incomplete HTML tags. This function is used
      to implement the striptags template filter, which was therefore also
      vulnerable. strip_tags() now raises a SuspiciousOperation exception if it
      encounters an unusually large number of unclosed opening tags.

      (Closes: #1104872)

    <https://www.djangoproject.com/weblog/2025/may/07/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 07 May 2025 09:27:26 -0700

python-django (3:5.2-1) experimental; urgency=medium

  * New upstream stable release.
    <https://www.djangoproject.com/weblog/2025/apr/02/django-52-released/>
  * Bump Standards-Version to 4.7.2.

 -- Chris Lamb <lamby@debian.org>  Fri, 04 Apr 2025 09:58:15 -0700

python-django (3:5.2~rc1-1) experimental; urgency=medium

  * New upstream release candidate.
    <https://www.djangoproject.com/weblog/2025/mar/19/django-52-rc1/>

 -- Chris Lamb <lamby@debian.org>  Wed, 19 Mar 2025 12:04:42 +0000

python-django (3:5.2~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2025/feb/19/django-52-beta-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 19 Feb 2025 11:41:40 +0000

python-django (3:5.2~alpha1-1) experimental; urgency=medium

  * New upstream alpha release.
    <https://www.djangoproject.com/weblog/2025/jan/16/django-52-alpha-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Thu, 16 Jan 2025 14:26:59 +0000

python-django (3:5.1.5-1) experimental; urgency=high

  * New upstream security release. (Closes: #1093049)

    - CVE-2024-56374: Potential denial-of-service vulnerability in IPv6
      validation.

      A lack of upper bound limit enforcement in strings passed when performing
      IPv6 validation could have led to a potential denial-of-service (DoS)
      attack. The undocumented and private functions clean_ipv6_address and
      is_valid_ipv6_address were vulnerable, as was the GenericIPAddressField
      form field, which has now been updated to define a max_length of 39
      characters. The GenericIPAddressField model field was not affected.

    <https://www.djangoproject.com/weblog/2025/jan/14/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 15 Jan 2025 17:48:05 +0000

python-django (3:5.1.4-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2024-53907: Potential DoS in django.utils.html.strip_tags.
      The strip_tags() method and striptags template filter were subject to a
      potential denial-of-service attack via certain inputs containing large
      sequences of nested incomplete HTML entities.

    - CVE-2024-53908: Potential SQL injection in HasKey(lhs, rhs) on Oracle
      Direct usage of the django.db.models.fields.json.HasKey lookup on Oracle
      was subject to SQL injection if untrusted data is used as a lhs value.
      Applications that use the jsonfield.has_key lookup through the __ syntax
      are unaffected.

    <https://www.djangoproject.com/weblog/2024/dec/04/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 04 Dec 2024 16:55:05 +0000

python-django (3:5.1.3-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/5.1/releases/5.1.3/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 05 Nov 2024 07:14:42 -0800

python-django (3:5.1.2-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/5.1/releases/5.1.2/>

 -- Chris Lamb <lamby@debian.org>  Tue, 08 Oct 2024 09:56:10 -0700

python-django (3:5.1.1-1) experimental; urgency=high

  * New upstream security release:

    - CVE-2024-45230: Potential denial-of-service vulnerability in
      django.utils.html.urlize(). urlize and urlizetrunc were subject to a
      potential denial-of-service attack via very large inputs with a specific
      sequence of characters.

    - CVE-2024-45231: Potential user email enumeration via response status on
      password reset. Due to unhandled email sending failures, the
      django.contrib.auth.forms.PasswordResetForm class allowed remote
      attackers to enumerate user emails by issuing password reset requests and
      observing the outcomes. To mitigate this risk, exceptions occurring
      during password reset email sending are now handled and logged using the
      django.contrib.auth logger.

  * Bump Standards-Version to 4.7.0.

 -- Chris Lamb <lamby@debian.org>  Tue, 03 Sep 2024 17:25:15 +0100

python-django (3:5.1-1) experimental; urgency=medium

  * New upstream 5.1 release.
    <https://www.djangoproject.com/weblog/2024/aug/07/django-51-released/>

 -- Chris Lamb <lamby@debian.org>  Wed, 07 Aug 2024 16:14:05 +0100

python-django (3:5.1~rc1-1) experimental; urgency=medium

  * New upstream 5.1 release candidate.
    <https://www.djangoproject.com/weblog/2024/jul/24/django-51-rc1/>

 -- Chris Lamb <lamby@debian.org>  Thu, 25 Jul 2024 11:33:24 +0100

python-django (3:5.1~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2024/jun/26/django-51-beta-1-released/>
  * Add pybuild-plugin-pyproject to Build-Depends.

 -- Chris Lamb <lamby@debian.org>  Wed, 26 Jun 2024 10:15:54 -0700

python-django (3:5.1~alpha1-1) experimental; urgency=medium

  * New upstream experimental alpha release.
    <https://www.djangoproject.com/weblog/2024/may/22/django-51-alpha-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Thu, 23 May 2024 10:48:03 +0100

python-django (3:5.0.6-1) experimental; urgency=medium

  * New upstream bugfix release, incorporating changes from 5.0.5 as well.
    <https://docs.djangoproject.com/en/5.0/releases/5.0.5/>
    <https://docs.djangoproject.com/en/5.0/releases/5.0.6/>

 -- Chris Lamb <lamby@debian.org>  Wed, 08 May 2024 11:12:00 +0100

python-django (3:5.0.4-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/dev/releases/5.0.4/>

 -- Chris Lamb <lamby@debian.org>  Thu, 04 Apr 2024 10:07:42 +0100

python-django (3:5.0.3-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2024-27351: Fix a potential regular expression denial-of-service
      (ReDoS) attack in django.utils.text.Truncator.words. This method
      (with html=True) and the truncatewords_html template filter were subject
      to a potential regular expression denial-of-service attack via a suitably
      crafted string. This is, in part, a follow up to CVE-2019-14232 and
      CVE-2023-43665.

    <https://docs.djangoproject.com/en/dev/releases/5.0.3/>

 -- Chris Lamb <lamby@debian.org>  Tue, 05 Mar 2024 12:37:11 +0000

python-django (3:5.0.2-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2024-24680: Potential denial-of-service in intcomma template filter.
      The intcomma template filter was subject to a potential denial-of-service
      attack when used with very long strings.

    <https://docs.djangoproject.com/en/dev/releases/5.0.2/>

 -- Chris Lamb <lamby@debian.org>  Tue, 06 Feb 2024 08:08:50 -0800

python-django (3:5.0.1-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/dev/releases/5.0.1/>

 -- Chris Lamb <lamby@debian.org>  Wed, 03 Jan 2024 11:07:26 +0000

python-django (3:5.0-1) experimental; urgency=medium

  * New upstream stable release.
    https://docs.djangoproject.com/en/5.0/releases/5.0/

 -- Chris Lamb <lamby@debian.org>  Thu, 07 Dec 2023 12:52:28 +0000

python-django (3:5.0~rc1-1) experimental; urgency=medium

  * New upstream RC1 release.
    <https://www.djangoproject.com/weblog/2023/nov/20/django-50-rc1/>

 -- Chris Lamb <lamby@debian.org>  Tue, 21 Nov 2023 08:43:43 +0000

python-django (3:5.0~alpha1-1) experimental; urgency=medium

  * New upstream alpha release.
    <https://www.djangoproject.com/weblog/2023/sep/18/django-50-alpha-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 19 Sep 2023 11:09:34 -0700

python-django (3:4.2.5-1) experimental; urgency=high

  * New upstream security release:

    - CVE-2023-41164: Potential denial of service vulnerability in
      django.utils.encoding.uri_to_iri(). This method was subject to potential
      denial of service attack via certain inputs with a very large number of
      Unicode characters. (Closes: #1051226)

    <https://www.djangoproject.com/weblog/2023/sep/04/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Mon, 04 Sep 2023 10:41:05 -0700

python-django (3:4.2.4-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/4.2/releases/4.2.4/>

 -- Chris Lamb <lamby@debian.org>  Wed, 02 Aug 2023 07:53:39 +0100

python-django (3:4.2.3-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2023-36053: Potential regular expression denial of service
      vulnerability in EmailValidator/URLValidator.

      EmailValidator and URLValidator were subject to potential regular
      expression denial of service attack via a very large number of domain
      name labels of emails and URLs. (Closes: #1040225)

 -- Chris Lamb <lamby@debian.org>  Mon, 03 Jul 2023 17:28:20 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python-django-doc`.
