python-django (3:5.2.16-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2026-48588: UpdateCacheMiddleware and the @cache_page decorator
      cached responses that vary on cookies when the incoming request carried
      unrelated cookies, which allowed remote attackers to read private data
      from the shared cache.

    - CVE-2026-53877: django.contrib.gis.gdal.GDALRaster over-read its
      in-memory buffer when constructed from a bytes object, which could
      disclose adjacent memory or cause service degradation via a potential
      segmentation fault when the vsi_buffer property is accessed.

    - CVE-2026-53878: DomainNameValidator did not prohibit newlines in domain
      names (unless used via a form field, since CharField strips newlines). If
      an application used values with newlines in an HTTP response, header
      injection could occur. Django itself is unaffected because HttpResponse
      prohibits newlines in HTTP headers.

    <https://www.djangoproject.com/weblog/2026/jul/07/security-releases/>

    (Closes: #1141629)

  * Bump debhelper compatibility level to 14.

 -- Chris Lamb <lamby@debian.org>  Tue, 07 Jul 2026 09:28:48 -0700

python-django (3:5.2.15-2) unstable; urgency=medium

  * Apply a patch from upstream to fix a FTBFS with gettext 0.26.
    (Closes: #1126978)

 -- Chris Lamb <lamby@debian.org>  Mon, 08 Jun 2026 09:24:04 -0700

python-django (3:5.2.15-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2026-6873: Signed cookie salt namespace collision in
      django.http.HttpRequest.get_signed_cookie

      get_signed_cookie derived the signing salt by concatenating the cookie
      name (key) and salt arguments. When distinct name and salt pairs produced
      the same concatenation, cookies could be accepted in a context different
      from the one where they were signed.

      Cookies are now signed with an unambiguous salt derivation. For backwards
      compatibility, cookies signed by older Django versions are accepted until
      Django 7.0.

    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in
      the SMTP backend

      When using EMAIL_USE_TLS, a failed STARTTLS handshake could leave a
      partially-initialized connection that would subsequently be reused for
      sending email without encryption. This can occur with fail_silently=True,
      as used by send_mail and BrokenLinkEmailsMiddleware among others.
      Connections configured with EMAIL_USE_SSL are not affected.

    - CVE-2026-8404: Potential exposure of private data via case-sensitive
      Cache-Control directives in UpdateCacheMiddleware

      django.middleware.cache.UpdateCacheMiddleware and
      django.views.decorators.cache.cache_page decorator incorrectly cached
      responses marked with private Cache-Control directives when using mixed
      or uppercase values (e.g. Private).

      The django.views.decorators.cache.cache_control decorator and
      django.utils.cache.patch_cache_control function were not affected
      since they normalize directives to lowercase. This issue only affects
      responses where Cache-Control is set manually.

    - CVE-2026-35193: Potential exposure of private data via missing Vary:
      Authorization in UpdateCacheMiddleware

      django.middleware.cache.UpdateCacheMiddleware and
      django.views.decorators.cache.cache_page decorator allowed responses to
      requests bearing an Authorization header (and without Cache-Control:
      public) to be cached. To conform with the existing mechanism for
      constructing cache keys, responses to these requests will now vary on
      Authorization.

    - CVE-2026-48587: Potential exposure of private data via whitespace padding
      in Vary header

      django.middleware.cache.UpdateCacheMiddleware incorrectly cached
      responses whose Vary header values contained leading or trailing
      whitespace. Because has_vary_header failed to strip that whitespace, a
      response with a "Vary: * "  header (note the trailing space) was not
      recognized as containing the wildcard, causing it to be stored and
      potentially served from the cache when it should not have been.

    <https://www.djangoproject.com/weblog/2026/jun/03/security-releases/>

    (Closes: #1138775)

 -- Chris Lamb <lamby@debian.org>  Wed, 03 Jun 2026 08:17:20 -0700

python-django (3:5.2.14-2) unstable; urgency=medium

  [ Athos Ribeiro ]
  * Cherry-pick patch to skip NOT NULL constraints on PostgreSQL 18.
    This addresses an issue that surfaces in python-django-postgres-extra.
    (LP: #2136172)

 -- Chris Lamb <lamby@debian.org>  Tue, 12 May 2026 08:26:33 -0700

python-django (3:5.2.14-1) unstable; urgency=high

  * New upstream security release:

     - CVE-2026-5766: Prevent a potential denial-of-service vulnerability in
       ASGI requests via a file upload limit bypass. ASGI requests with a
       missing or understated Content-Length header could bypass the
       FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
       memory and causing service degradation. As a reminder, Django expects a
       limit to be configured at the web server level rather than solely relying
       on FILE_UPLOAD_MAX_MEMORY_SIZE.

     - CVE-2026-35192: Address a session fixation issue via public cached pages
       and SESSION_SAVE_EVERY_REQUEST. Response headers did not vary on cookies
       if a session was not modified but SESSION_SAVE_EVERY_REQUEST was True. A
       remote attacker could therefore steal a user's session after that user
       visits a cached public page.

     - CVE-2026-6907: Prevent a potential exposure of private data due to incorrect
       handling of "Vary: *" in UpdateCacheMiddleware. Previously,
       django.middleware.cache.UpdateCacheMiddleware would erroneously cache
       requests where the Vary header contained an asterisk ('*'). This could
       lead to private data being stored and served.

     (Closes: #1135755)

  * Bump Standards-Version to 4.7.4.

 -- Chris Lamb <lamby@debian.org>  Tue, 05 May 2026 09:42:54 -0700

python-django (3:5.2.13-1) unstable; urgency=medium

  * Upload of 5.2 branch to unstable. (Closes: #1102743)
  * New upstream security release:

    - CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation.
      ASGIRequest normalizes header names following WSGI conventions, mapping
      hyphens to underscores. As a result, even in configurations where reverse
      proxies carefully strip security-sensitive headers named with hyphens,
      such a header could be spoofed by supplying a header named with
      underscores. Under WSGI, it is the responsibility of the server or proxy
      to avoid ambiguous mappings. (Django's runserver was patched via
      CVE-2015-0219.) But under ASGI, there is not the same uniform
      expectation, even if many proxies protect against this under default
      configuration (including nginx via underscores_in_headers off;). Headers
      containing underscores are now ignored by ASGIRequest, matching the
      behavior of Daphne, the reference server for ASGI.

    - CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin. Add
      permissions on inline model instances were not validated on submission of
      forged POST data in GenericInlineModelAdmin.

    - CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable. Admin
      changelist forms using ModelAdmin.list_editable incorrectly allowed new
      instances to be created via forged POST data.

    - CVE-2026-33033: Potential denial-of-service vulnerability in
      MultiPartParser via base64-encoded file upload. When using
      django.http.multipartparser.MultiPartParser, multipart uploads with
      Content-Transfer-Encoding: base64 that include excessive whitespace may
      trigger repeated memory copying, potentially degrading performance.

    - CVE-2026-33034: Potential denial-of-service vulnerability in ASGI
      requests via memory upload limit bypass. ASGI requests with a missing or
      understated Content-Length header could bypass the
      DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body,
      potentially loading an unbounded request body into memory and causing
      service degradation.

    <https://www.djangoproject.com/weblog/2026/apr/07/security-releases/>

    (Closes: #1132927)

  * Don't test Sphinx/GitHub interlinks during autopkgtests. These tests are
    essentially hardcoded to rely on the "django" Python package to
    reside adjacent to the tests in the directory tree. In the context of an
    autopkgtest, however, the "django" package must exist an installed
    package (ie. via the .deb) under /usr/lib/python3, etc.
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 28 Apr 2026 09:58:21 -0700

python-django (3:5.2.12-1) unstable; urgency=medium

  * New upstream 5.2.x release.

 -- Chris Lamb <lamby@debian.org>  Tue, 31 Mar 2026 11:22:12 -0700

python-django (3:4.2.30-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation.
      ASGIRequest normalizes header names following WSGI conventions, mapping
      hyphens to underscores. As a result, even in configurations where reverse
      proxies carefully strip security-sensitive headers named with hyphens,
      such a header could be spoofed by supplying a header named with
      underscores. Under WSGI, it is the responsibility of the server or proxy
      to avoid ambiguous mappings. (Django's runserver was patched via
      CVE-2015-0219.) But under ASGI, there is not the same uniform
      expectation, even if many proxies protect against this under default
      configuration (including nginx via underscores_in_headers off;). Headers
      containing underscores are now ignored by ASGIRequest, matching the
      behavior of Daphne, the reference server for ASGI.

    - CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin. Add
      permissions on inline model instances were not validated on submission of
      forged POST data in GenericInlineModelAdmin.

    - CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable. Admin
      changelist forms using ModelAdmin.list_editable incorrectly allowed new
      instances to be created via forged POST data.

    - CVE-2026-33033: Potential denial-of-service vulnerability in
      MultiPartParser via base64-encoded file upload. When using
      django.http.multipartparser.MultiPartParser, multipart uploads with
      Content-Transfer-Encoding: base64 that include excessive whitespace may
      trigger repeated memory copying, potentially degrading performance.

    - CVE-2026-33034: Potential denial-of-service vulnerability in ASGI
      requests via memory upload limit bypass. ASGI requests with a missing or
      understated Content-Length header could bypass the
      DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body,
      potentially loading an unbounded request body into memory and causing
      service degradation.

    <https://www.djangoproject.com/weblog/2026/apr/07/security-releases/>

    (Closes: #1132927)

 -- Chris Lamb <lamby@debian.org>  Tue, 07 Apr 2026 14:04:57 -0400

python-django (3:4.2.29-1) unstable; urgency=high

  * New upstream sceurity release:

    - CVE-2026-25674: Potential incorrect permissions on newly created file
      system objects.

      Django's file-system storage and file-based cache backends used the
      process umask to control permissions when creating directories. In
      multi-threaded environments, one thread's temporary umask change can
      affect other threads' file and directory creation, resulting in file
      system objects being created with unintended permissions. Django now
      applies the requested permissions via os.chmod() after os.mkdir(),
      removing the dependency on the process-wide umask.

    - CVE-2026-25673: Potential denial-of-service vulnerability in URLField via
      Unicode normalization on Windows.

      The django.forms.URLField form field's to_python() method used
      urllib.parse.urlsplit() to determine whether to prepend a URL scheme to
      the submitted value. On Windows, urlsplit() performs NFKC normalization
      (unicodedata.normalize), which can be disproportionately slow for large
      inputs containing certain characters.

      URLField.to_python() now uses a simplified scheme detection, avoiding
      Unicode normalization entirely and deferring URL validation to the
      appropriate layers. As a result, while leading and trailing whitespace is
      still stripped by default, characters such as newlines, tabs, and other
      control characters within the value are no longer handled by
      URLField.to_python(). When using the default URLValidator, these values
      will continue to raise ValidationError during validation, but if you rely
      on custom validators, ensure they do not depend on the previous behavior
      of URLField.to_python().

    <https://www.djangoproject.com/weblog/2026/mar/03/security-releases/>

    (Closes: #1129595)

 -- Chris Lamb <lamby@debian.org>  Tue, 03 Mar 2026 09:48:56 -0800

python-django (3:4.2.28-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2025-13473: The check_password function in
      django.contrib.auth.handlers.modwsgi for authentication via mod_wsgi
      allowed remote attackers to enumerate users via a timing attack.

    - CVE-2025-14550: ASGIRequest allowed a remote attacker to cause a
      potential denial-of-service via a crafted request with multiple duplicate
      headers.

    - CVE-2026-1207: Raster lookups on RasterField (only implemented on
      PostGIS) allowed remote attackers to inject SQL via the band index
      parameter.

    - CVE-2026-1285: The django.utils.text.Truncator.chars() and
      Truncator.words() methods (with html=True) and the truncatechars_html and
      truncatewords_html template filters allowed a remote attacker to cause a
      potential denial-of-service via crafted inputs containing a large number
      of unmatched HTML end tags.

    - CVE-2026-1287: FilteredRelation was subject to SQL injection in column
      aliases via control characters using a suitably crafted dictionary, with
      dictionary expansion, as the **kwargs passed to QuerySet methods
      annotate(), aggregate(), extra(), values(), values_list() and alias().

    - CVE-2026-1312: QuerySet.order_by() was subject to SQL injection in column
      aliases containing periods when the same alias is, using a suitably
      crafted dictionary, with dictionary expansion, used in FilteredRelation.

    <https://www.djangoproject.com/weblog/2026/feb/03/security-releases/>

    (Closes: #1126914)

  * Drop debian/patches/test-strip-tags-incomplete-entities.patch; applied upstream.
  * Refresh patches.
  * Bump Standards-Version to 4.7.3.

 -- Chris Lamb <lamby@debian.org>  Wed, 04 Feb 2026 07:50:22 -0800

python-django (3:4.2.28-0+deb13u1) trixie-security; urgency=high

  * New upstream security release:

    - CVE-2025-13473: The check_password function in
      django.contrib.auth.handlers.modwsgi for authentication via mod_wsgi
      allowed remote attackers to enumerate users via a timing attack.

    - CVE-2025-14550: When receiving duplicates of a single header, ASGIRequest
      allowed a remote attacker to cause a potential denial-of-service via a
      specifically created request with multiple duplicate headers. The
      vulnerability resulted from repeated string concatenation while combining
      repeated headers, which produced super-linear computation resulting in
      service degradation or outage.

    - CVE-2026-1207: Raster lookups on RasterField (only implemented on
      PostGIS) allowed remote attackers to inject SQL via the band index
      parameter.

    - CVE-2026-1285: The django.utils.text.Truncator.chars() and
      Truncator.words() methods (with html=True) and the truncatechars_html and
      truncatewords_html template filters allowed a remote attacker to cause a
      potential denial-of-service via crafted inputs containing a large number
      of unmatched HTML end tags.

    - CVE-2026-1287: FilteredRelation was subject to SQL injection in column
      aliases via control characters using a suitably crafted dictionary, with
      dictionary expansion, as the **kwargs passed to QuerySet methods
      annotate(), aggregate(), extra(), values(), values_list() and alias().

    - CVE-2026-1312: QuerySet.order_by() was subject to SQL injection in column
      aliases containing periods when the same alias is, using a suitably
      crafted dictionary, with dictionary expansion, used in FilteredRelation.

    <https://docs.djangoproject.com/en/dev/releases/4.2.28/> (Closes: #1126914)

 -- Chris Lamb <lamby@debian.org>  Wed, 18 Feb 2026 14:44:14 -0800

python-django (3:4.2.27-2) unstable; urgency=medium

  * Team upload.
  * Backport various upstream fixes for newer Python versions (closes:
    #1122185):
    - Fixed tests for test --parallel option on Python 3.14+.
    - Fixed copying BaseContext and its subclasses on Python 3.14+.
    - Fixed OtherModelFormTests.test_prefetch_related_queryset() test on
      Python 3.14+.
    - Adjusted test_strip_tags following Python behavior change for
      incomplete entities.
  * Revert "Mark that Python 3.14 is not supported yet", since it now is.

 -- Colin Watson <cjwatson@debian.org>  Wed, 17 Dec 2025 10:23:30 +0000

python-django (3:4.2.27-1) unstable; urgency=medium

  * New upstream security release.
    <https://www.djangoproject.com/weblog/2025/dec/02/security-releases/>

    - CVE-2025-13372: Fix a potential SQL injection attack in FilteredRelation
      column aliases when using PostgreSQL. FilteredRelation was subject to SQL
      injection in column aliases via a suitably crafted dictionary as the
      **kwargs passed to QuerySet.annotate() or QuerySet.alias().

    - CVE-2025-64460: Prevent a potential denial-of-service vulnerability in
      XML serializer text extraction. An algorithmic complexity issue in
      django.core.serializers.xml_serializer.getInnerText() allowed a remote
      attacker to cause a potential denial-of-service triggering CPU and memory
      exhaustion via a specially crafted XML input submitted to a service that
      invokes XML Deserializer. The vulnerability resulted from repeated string
      concatenation while recursively collecting text nodes, which produced
      superlinear computation.

    (Closes: #1121788))

  * Mark that Python 3.14 is not supported yet.

 -- Chris Lamb <lamby@debian.org>  Tue, 02 Dec 2025 11:34:10 -0800

python-django (3:4.2.27-0+deb13u1) trixie-security; urgency=high

  * New upstream security release:

    - CVE-2025-13372: Fix a potential SQL injection attack in FilteredRelation
      column aliases when using PostgreSQL. FilteredRelation was subject to SQL
      injection in column aliases via a suitably crafted dictionary as the
      **kwargs passed to QuerySet.annotate() or QuerySet.alias().

    - CVE-2025-57833: Potential SQL injection in FilteredRelation column
      aliases. The FilteredRelation feature in Django was subject to a
      potential SQL injection vulnerability in column aliases that was
      exploitable via suitably crafted dictionary with dictionary expansion as
      the **kwargs passed QuerySet.annotate() or QuerySet.alias(). This CVE
      was fixed in Django 4.2.24. (Closes: #1113865)

    - CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(),
      aggregate() and extra() on MySQL and MariaDB. QuerySet.annotate(),
      QuerySet.alias(), QuerySet.aggregate() and QuerySet.extra() methods were
      subject to SQL injection in column aliases, using a suitably crafted
      dictionary with dictionary expansion as the **kwargs passed to these
      methods on MySQL and MariaDB. This CVE was fixed in Django 4.2.25.

    - CVE-2025-59682: Potential partial directory-traversal via
      archive.extract(). The django.utils.archive.extract() function, used by
      startapp --template and startproject --template allowed partial
      directory-traversal via an archive with file paths sharing a common
      prefix with the target directory. This CVE was fixed in Django 4.2.25.

    - CVE-2025-64459: Prevent a potential SQL injection via _connector keyword
      argument in QuerySet/Q objects. The methods QuerySet.filter(),
      QuerySet.exclude(), and QuerySet.get() and the class Q() were subject to
      SQL injection when using a suitably crafted dictionary (with dictionary
      expansion) as the _connector argument. This CVE was fixed in Django
      4.2.26.

    - CVE-2025-64460: Prevent a potential denial-of-service vulnerability in
      XML serializer text extraction. An algorithmic complexity issue in
      django.core.serializers.xml_serializer.getInnerText() allowed a remote
      attacker to cause a potential denial-of-service triggering CPU and memory
      exhaustion via a specially crafted XML input submitted to a service that
      invokes XML Deserializer. The vulnerability resulted from repeated string
      concatenation while recursively collecting text nodes, which produced
      superlinear computation. (Closes: #1121788)

    <https://docs.djangoproject.com/en/4.2/releases/4.2.27/>

 -- Chris Lamb <lamby@debian.org>  Fri, 23 Jan 2026 10:43:29 -0800

python-django (3:4.2.26-1) unstable; urgency=high

  * New upstream security release.
    <https://www.djangoproject.com/weblog/2025/nov/05/security-releases/>

    - CVE-2025-64458: Fix a potential denial-of-service vulnerability in
      HttpResponseRedirect and HttpResponsePermanentRedirect. NFKC
      normalization in Python is slow on Windows; as a consequence,
      HttpResponseRedirect, HttpResponsePermanentRedirect and redirect were
      subject to a potential denial-of-service attack via certain inputs with
      a very large number of Unicode characters.

    - CVE-2025-64459: Prevent a potential SQL injection via _connector keyword
      argument in QuerySet/Q objects. The methods QuerySet.filter(),
      QuerySet.exclude(), and QuerySet.get() and the class Q() were subject to
      SQL injection when using a suitably crafted dictionary (with dictionary
      expansion) as the _connector argument.

  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 05 Nov 2025 08:36:26 -0800

python-django (3:4.2.25-2) unstable; urgency=medium

  * Team upload.
  * Skip NOT NULL constraints on PostgreSQL 18+ (closes: #1117647).

 -- Colin Watson <cjwatson@debian.org>  Wed, 22 Oct 2025 10:05:23 +0100

python-django (3:4.2.25-1) unstable; urgency=high

  * New upstream security release (Closes: #1116979):

    - CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(),
      aggregate() and extra() on MySQL and MariaDB.

      QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate() and
      QuerySet.extra() methods were subject to SQL injection in column aliases,
      using a suitably crafted dictionary with dictionary expansion as the
      **kwargs passed to these methods on MySQL and MariaDB.

    - CVE-2025-59682: Potential partial directory-traversal via
      archive.extract()

      The django.utils.archive.extract() function, used by startapp --template
      and startproject --template allowed partial directory-traversal via an
      archive with file paths sharing a common prefix with the target
      directory.

    <https://www.djangoproject.com/weblog/2025/oct/01/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 01 Oct 2025 11:17:18 -0700

python-django (3:4.2.24-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2025-57833: Potential SQL injection in FilteredRelation column
      aliases. The FilteredRelation feature in Django was subject to a
      potential SQL injection vulnerability in column aliases that was
      exploitable via suitably crafted dictionary with dictionary expansion as
      the **kwargs passed QuerySet.annotate() or QuerySet.alias().
      (Closes: #1113865)

    <https://www.djangoproject.com/weblog/2025/sep/03/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 03 Sep 2025 08:28:19 -0700

python-django (3:4.2.23-1) unstable; urgency=high

  * New upstream bugfix release. Quoting upstream:

      Following the June 4, 2025 security release [uploaded to Debian as
      3:4.2.22-1], the Django team is issuing releases [to] complete mitigation
      for CVE-2025-48432 […].

      These follow-up releases migrate remaining response logging paths to a
      safer logging implementation, ensuring that all untrusted input is
      properly escaped before being written to logs. This update does not
      introduce a new CVE but strengthens the original fix.

    <https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/>

 -- Chris Lamb <lamby@debian.org>  Tue, 10 Jun 2025 09:37:03 -0700

python-django (3:4.2.22-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2025-48432: Potential log injection via unescaped request path.

      Django's internal HTTP response logging used request.path directly,
      allowing control characters (e.g. newlines or ANSI escape sequences) to
      be written unescaped into logs. This could enable log injection or
      forgery, letting attackers manipulate log appearance or structure,
      especially in logs processed by external systems or viewed in terminals.

      Although this does not directly impact Django's security model, it poses
      risks when logs are consumed or interpreted by other tools.  To fix this,
      the internal django.utils.log.log_response() function now escapes all
      positional formatting arguments using a safe encoding.

      (Closes: #1107282)

    <https://www.djangoproject.com/weblog/2025/jun/04/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 04 Jun 2025 08:21:53 -0700

python-django (3:4.2.21-1) unstable; urgency=medium

  * New upstream security release:

    - CVE-2025-32873: Denial-of-service possibility in strip_tags()

      django.utils.html.strip_tags() would be slow to evaluate certain inputs
      containing large sequences of incomplete HTML tags. This function is used
      to implement the striptags template filter, which was therefore also
      vulnerable. strip_tags() now raises a SuspiciousOperation exception if it
      encounters an unusually large number of unclosed opening tags.

      (Closes: #1104872)

    <https://www.djangoproject.com/weblog/2025/may/07/security-releases/>

  * Bump Standards-Version to 4.7.2.
  * Add pybuild-plugin-pyproject to Build-Depends.

 -- Chris Lamb <lamby@debian.org>  Fri, 09 May 2025 15:47:11 -0700

python-django (3:4.2.20-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2025-26699: Address a potential denial-of-service in
      django.utils.text.wrap. The wrap() method and wordwrap template filter
      were subject to a potential denial-of-service attack when used with very
      long strings. (Closes: #1099682)

    <https://www.djangoproject.com/weblog/2025/mar/06/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Thu, 06 Mar 2025 17:55:06 +0000

python-django (3:4.2.19-1) unstable; urgency=medium

  * New upstream bugfix release.
    <https://www.djangoproject.com/weblog/2025/feb/05/bugfix-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 05 Feb 2025 16:45:05 +0000

python-django (3:4.2.18-1) unstable; urgency=high

  * New upstream security release. (Closes: #1093049)

    - CVE-2024-56374: Potential denial-of-service vulnerability in IPv6
      validation.

      A lack of upper bound limit enforcement in strings passed when performing
      IPv6 validation could have led to a potential denial-of-service (DoS)
      attack. The undocumented and private functions clean_ipv6_address and
      is_valid_ipv6_address were vulnerable, as was the GenericIPAddressField
      form field, which has now been updated to define a max_length of 39
      characters. The GenericIPAddressField model field was not affected.

    <https://www.djangoproject.com/weblog/2025/jan/14/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 15 Jan 2025 17:38:10 +0000

python-django (3:4.2.17-2) unstable; urgency=medium

  * Team upload.
  * Fix CommandTypes.test_help_default_options_with_custom_arguments test on
    Python 3.13+ (closes: #1082209).

 -- Colin Watson <cjwatson@debian.org>  Thu, 02 Jan 2025 15:36:58 +0000

python-django (3:4.2.17-1) unstable; urgency=medium

  * New upstream security release:

    - CVE-2024-53907: Potential DoS in django.utils.html.strip_tags.
      The strip_tags() method and striptags template filter were subject to a
      potential denial-of-service attack via certain inputs containing large
      sequences of nested incomplete HTML entities.

    - CVE-2024-53908: Potential SQL injection in HasKey(lhs, rhs) on Oracle
      Direct usage of the django.db.models.fields.json.HasKey lookup on Oracle
      was subject to SQL injection if untrusted data is used as a lhs value.
      Applications that use the jsonfield.has_key lookup through the __ syntax
      are unaffected.

    <https://www.djangoproject.com/weblog/2024/dec/04/security-releases/>

  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 04 Dec 2024 17:33:13 +0000

python-django (3:4.2.16-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2024-45230: Potential denial-of-service vulnerability in
      django.utils.html.urlize(). urlize and urlizetrunc were subject to a
      potential denial-of-service attack via very large inputs with a specific
      sequence of characters.

    - CVE-2024-45231: Potential user email enumeration via response status on
      password reset. Due to unhandled email sending failures, the
      django.contrib.auth.forms.PasswordResetForm class allowed remote
      attackers to enumerate user emails by issuing password reset requests and
      observing the outcomes. To mitigate this risk, exceptions occurring
      during password reset email sending are now handled and logged using the
      django.contrib.auth logger.

  * Bump Standards-Version to 4.7.0.

 -- Chris Lamb <lamby@debian.org>  Tue, 03 Sep 2024 17:31:33 +0100

python-django (3:4.2.15-1) unstable; urgency=high

  * New upstream security release. (Closes: #1078074)

    - CVE-2024-41989: Memory exhaustion in django.utils.numberformat.

      The floatformat template filter is subject to significant memory
      consumption when given a string representation of a number in
      scientific notation with a large exponent.

    - CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize.

      The urlize() and urlizetrunc() template filters are subject to a
      potential denial-of-service attack via very large inputs with a specific
      sequence of characters.

    - CVE-2024-41991: Potential denial-of-service vulnerability in
      django.utils.html.urlize() and AdminURLFieldWidget

      The urlize and urlizetrunc template filters, and the AdminURLFieldWidget
      widget, are subject to a potential denial-of-service attack via certain
      inputs with a very large number of Unicode characters.

    - CVE-2024-42005: Potential SQL injection in QuerySet.values() and
      values_list()

      QuerySet.values() and values_list() methods on models with a JSONField
      are subject to SQL injection in column aliases via a crafted JSON object
      key as a passed *arg.

    <https://www.djangoproject.com/weblog/2024/aug/06/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Tue, 06 Aug 2024 16:59:24 +0100

python-django (3:4.2.14-1) unstable; urgency=medium

  * New upstream security release. (Closes: #1076069)

    - CVE-2024-38875: Prevent a potential denial-of-service in
      django.utils.html.urlize. This method (and urlizetrunc) were subject to a
      potential DoS attack via specially-crafted inputs with a very large
      number of brackets.

    - CVE-2024-39329: Avoid a username enumeration vulnerability through timing
      difference for users with unusable password. The authenticate method of
      django.contrib.auth.backends.ModelBackend method allowed remote attackers
      to enumerate users via a timing attack involving login requests for users
      with unusable passwords.

    - CVE-2024-39330: Address a potential directory-traversal in
      django.core.files.storage.Storage.save. Derived classes of this method's
      base class which override generate_filename without replicating the file
      path validations existing in the parent class allowed for potential
      directory-traversal via certain inputs when calling save(). Built-in
      Storage sub-classes were not affected by this vulnerability.

    - CVE-2024-39614: Fix a potential denial-of-service in
      django.utils.translation.get_supported_language_variant. This method
      was subject to a potential DoS attack when used with very long strings
      containing specific characters. To mitigate this vulnerability, the
      language code provided to get_supported_language_variant is now parsed up
      to a maximum length of 500 characters.

    <https://www.djangoproject.com/weblog/2024/jul/09/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 10 Jul 2024 09:50:49 +0100

python-django (3:4.2.13-1) unstable; urgency=medium

  * New upstream bugfix releases.
    <https://docs.djangoproject.com/en/5.0/releases/4.2.12/>
    <https://docs.djangoproject.com/en/5.0/releases/4.2.13/>

 -- Chris Lamb <lamby@debian.org>  Wed, 08 May 2024 11:28:44 +0100

python-django (3:4.2.11-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2024-27351: Fix a potential regular expression denial-of-service
      (ReDoS) attack in django.utils.text.Truncator.words. This method
      (with html=True) and the truncatewords_html template filter were subject
      to a potential regular expression denial-of-service attack via a suitably
      crafted string. This is, in part, a follow up to CVE-2019-14232 and
      CVE-2023-43665.

    <https://docs.djangoproject.com/en/dev/releases/4.2.11/>

 -- Chris Lamb <lamby@debian.org>  Tue, 05 Mar 2024 13:03:35 +0000

python-django (3:4.2.10-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2024-24680: Potential denial-of-service in intcomma template filter.
      The intcomma template filter was subject to a potential denial-of-service
      attack when used with very long strings.

    <https://docs.djangoproject.com/en/dev/releases/4.2.10/>

 -- Chris Lamb <lamby@debian.org>  Tue, 06 Feb 2024 08:15:25 -0800

python-django (3:4.2.9-1) unstable; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/dev/releases/4.2.9/>

 -- Chris Lamb <lamby@debian.org>  Wed, 03 Jan 2024 11:15:04 +0000

python-django (3:4.2.8-1) unstable; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/5.0/releases/4.2.8/>

 -- Chris Lamb <lamby@debian.org>  Thu, 07 Dec 2023 13:05:03 +0000

python-django (3:4.2.6-1) unstable; urgency=high

  * New upstream security release.

    - CVE-2023-43665: Address a denial-of-service possibility in
      django.utils.text.Truncator.

      Following the fix for CVE-2019-14232, the regular expressions used in the
      implementation of django.utils.text.Truncator’s chars() and words()
      methods (with html=True) were revised and improved. However, these
      regular expressions still exhibited linear backtracking complexity, so
      when given a very long, potentially malformed HTML input, the evaluation
      would still be slow, leading to a potential denial of service
      vulnerability.

      The chars() and words() methods are used to implement the
      truncatechars_html and truncatewords_html template filters, which were
      thus also vulnerable.

      The input processed by Truncator, when operating in HTML mode, has been
      limited to the first five million characters in order to avoid potential
      performance and memory issues.

    <https://www.djangoproject.com/weblog/2023/oct/04/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Thu, 05 Oct 2023 09:17:06 +0200

python-django (3:4.2.5-2) unstable; urgency=medium

  * Upload 4.2.x branch to unstable with a -2 suffix to prevent collision with
    previous upload of 3:4.2.5-1 to experimental.

 -- Chris Lamb <lamby@debian.org>  Sun, 24 Sep 2023 13:52:16 -0700

python-django (3:3.2.21-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2023-41164: Potential denial of service vulnerability in
      django.utils.encoding.uri_to_iri(). This method was subject to potential
      denial of service attack via certain inputs with a very large number of
      Unicode characters. (Closes: #1051226)

    <https://www.djangoproject.com/weblog/2023/sep/04/security-releases/>

  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Mon, 04 Sep 2023 11:02:53 -0700

python-django (3:3.2.20-1.1) unstable; urgency=high

  [ Gianfranco Costamagna ]
  * Non-maintainer upload.

  [ Graham Inggs ]
  * Cherry-pick upstream commit to fix URLValidator crash in
    some edge cases (LP: #2025155, Closes: #1037920)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 04 Jul 2023 09:31:10 +0200

python-django (3:3.2.20-1) unstable; urgency=high

  * New upstream security release:

    - CVE-2023-36053: Potential regular expression denial of service
      vulnerability in EmailValidator/URLValidator.

      EmailValidator and URLValidator were subject to potential regular
      expression denial of service attack via a very large number of domain
      name labels of emails and URLs. (Closes: #1040225)

 -- Chris Lamb <lamby@debian.org>  Mon, 03 Jul 2023 20:34:24 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python3-django`.
