stable

python-django4.2-4.2.28-1.fc42

FEDORA-2026-ca3d81129a created by salimma 6 months ago for Fedora 42
  • Fixes CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler
  • Fixes CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI
  • Fixes CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS
  • Fixes CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
  • Fixes CVE-2026-1287: Potential SQL injection in column aliases via control characters
  • Fixes CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-ca3d81129a

This update has been submitted for testing by salimma.

6 months ago

This update's test gating status has been changed to 'ignored'.

6 months ago

This update has been pushed to testing.

6 months ago

This update has been submitted for stable by bodhi.

6 months ago

This update has been pushed to stable.

5 months ago

Please log in to add feedback.

Metadata
Type
security
Severity
high
Karma
0
Signed
Content Type
RPM
Test Gating
Autopush Settings
Unstable by Karma
-3
Stable by Karma
2
Stable by Time
7 days
Dates
submitted
6 months ago
in testing
6 months ago
in stable
5 months ago
approved
6 months ago
Builds
1
python-django4.2-4.2.28-1.fc42
BZ#2436703 CVE-2026-1287 python-django4.2: Django: SQL Injection via crafted column aliases [fedora-42]
0
0
BZ#2436705 CVE-2026-1312 python-django4.2: Django: SQL injection via crafted column aliases in QuerySet.order_by() [fedora-42]
0
0
BZ#2436711 CVE-2026-1285 python-django4.2: Django: Denial of Service via crafted HTML inputs [fedora-42]
0
0
BZ#2436720 CVE-2025-14550 python-django4.2: Django: Denial of Service via crafted request with duplicate headers [fedora-42]
0
0
BZ#2436722 CVE-2026-1207 python-django4.2: Django: SQL Injection via RasterField band index parameter [fedora-42]
0
0
python-django4.2-4.2.28-1.fc42

Automated Test Results

Copyright © 2007-2026 Red Hat, Inc. and others.

Running bodhi-server 26.4.0 on bodhi-web-6d5f467446-vwmmw.

bodhi is Free Software. Please file issues if you have any problems. Read the documentation.

• Composes • Legal • Privacy policy •