[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [SECURITY] [DLA 4324-1] python-django security update

We dont run this via debian packages, but we are running a vulnerable version anyway. Fixed in https://docs.djangoproject.com/en/dev/releases/4.2.25/
We are not using mysql together with django I think, so it is not as urgent. (severity low) 

On 10/8/25 19:19, Chris Lamb wrote:

-------------------------------------------------------------------------
Debian LTS Advisory DLA-4324-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
October 07, 2025                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python-django
Version        : 2:2.2.28-1~deb11u9
CVE IDs        : CVE-2025-59681 CVE-2025-59682
Debian Bug     : 1116979

It was discovered that there were two vulnerabilities in Django, a
popular web development framework:

  * CVE-2025-59681: Fix a potential SQL injection in
    QuerySet.annotate(), alias(), aggregate() and extra(). These
    methods were subject to SQL injection in column aliases, using a
    suitably crafted dictionary via dictionary expansion as the
    **kwargs passed to these methods on MySQL and MariaDB.

  * CVE-2025-59682: Fix a potential partial directory-traversal
    vulnerability in archive.extract(). This function, used by
    startapp --template and startproject --template allowed partial
    directory-traversal via an archive with file paths sharing a
    common prefix with the target directory.

For Debian 11 bullseye, these problems have been fixed in version
2:2.2.28-1~deb11u9.

We recommend that you upgrade your python-django packages.

For the detailed security status of python-django please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-django

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Reply to: