Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21313-1

Опубликовано: 10 июл. 2026
Источник: suse-cvrf

Описание

Security update for python-Django

This update for python-Django fixes the following issues:

Changes in python-Django:

  • CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response (bsc#1271029)
  • CVE-2026-53877: Heap buffer over-read in GDALRaster (bsc#1271030)
  • CVE-2026-53878: Header injection possibility since DomainNameValidator accepted newlines in input (bsc#1271031)

Список пакетов

openSUSE Leap 16.0
python313-Django-5.2.4-bp160.10.1

Ссылки

Описание

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.

Затронутые продукты
openSUSE Leap 16.0:python313-Django-5.2.4-bp160.10.1
Ссылки

Описание

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Затронутые продукты
openSUSE Leap 16.0:python313-Django-5.2.4-bp160.10.1
Ссылки

Описание

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Затронутые продукты
openSUSE Leap 16.0:python313-Django-5.2.4-bp160.10.1
Ссылки