Sun, 08 Nov 2026 11:12:03 UTC Log in

python-django5-5.2.17-2.fc45

failed
A high-level Python Web framework built by guoguo completed Thu, 29 Oct 2026 22:21:03 UTC
Task 124076

Description

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY (Don't Repeat Yourself) principle.

RPMs

No RPMs

Changelog

* Wed Sep 09 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.17-2
- Rebase setuptools patch and retarget to F43 and F44

* Wed Sep 09 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.17-1
- Update to version 5.2.17; Resolves: rhbz#2511083
- Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery
  via spatial lookups
- Fixes CVE-2026-15337 [low]: Potential denial-of-service vulnerability in
  check_for_language()
- Fixes CVE-2026-15830 [moderate]: Potential denial-of-service
  vulnerability via nested geometry collections
- Fixes CVE-2026-15920 [moderate]: Potential cross-site scripting via
  URLField values in the admin

* Thu Jul 16 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.16-1
- Update to version 5.2.16; Resolves RHBZ#2497734
- Fixes three low-severity CVEs
- CVE-2026-48588: Potential exposure of private data via cached Set-Cookie
  response
- CVE-2026-53877: Heap buffer over-read in GDALRaster
- CVE-2026-53878: Header injection possibility since DomainNameValidator
  accepted newlines in input

* Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.15-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

* Fri Jun 19 2026 Miro Hrončok <miro@hroncok.cz> - 5.2.15-5
- Heavily reduce the list of skipped tests

* Sat Jun 06 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.15-4
- Remove dump of disabled tests from the end of the spec

* Sat Jun 06 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.15-3
- Disable failing tests on Python 3.15

* Fri Jun 05 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.15-2
- Rebuilt for Python 3.15

* Fri Jun 05 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.15-1
- Update to version 5.2.15; Resolves RHBZ#2484354
- Fixes five low-severity CVEs
- CVE-2026-6873: Signed cookie salt namespace collision
- CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in
  the SMTP backend
- CVE-2026-8404: Potential exposure of private data via case-sensitive
  Cache-Control directives
- CVE-2026-35193: Potential exposure of private data via missing Vary:
  Authorization
- CVE-2026-48587: Potential exposure of private data via whitespace padding
  in Vary header

* Fri Jun 05 2026 Python Maint <python-maint@redhat.com> - 5.2.14-3
- Rebuilt for Python 3.15

* Thu Jun 04 2026 Python Maint <python-maint@redhat.com> - 5.2.14-2
- Bootstrap for Python 3.15

* Tue May 12 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.14-1
- Update to version 5.2.14; Resolves RHBZ#2444117
- Fixes CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
  requests via file upload limit bypass
- Fixes CVE-2026-35192: Session fixation via public cached pages and
  SESSION_SAVE_EVERY_REQUEST
- Fixes CVE-2026-6907: Potential exposure of private data due to incorrect
  handling of Vary: * in UpdateCacheMiddleware
- Fixes CVE-2026-3902: ASGI header spoofing via underscore/hyphen
  conflation
- Fixes CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
- Fixes CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
- Fixes CVE-2026-33033: Potential denial-of-service vulnerability in
  MultiPartParser via base64-encoded file upload
- Fixes CVE-2026-33034: Potential denial-of-service vulnerability in ASGI
  requests via memory upload limit bypass
- Fixes CVE-2026-25674: Potential incorrect permissions on newly created
  file system objects

* Thu Feb 19 2026 Michel Lind <salimma@fedoraproject.org> - 5.2.11-1
- Update to version 5.2.11; Resolves: RHBZ#2427483
- `python-django5` is now the alternate `python3-django5` on Fedora 44+,
  `python3-django` is now Django 6.x
- Fixes CVE-2025-13473: Username enumeration through timing difference in
  mod_wsgi authentication handler
- Fixes CVE-2025-14550: Potential denial-of-service vulnerability via
  repeated headers when using ASGI
- Fixes CVE-2026-1207: Potential SQL injection via raster lookups on
  PostGIS
- Fixes CVE-2026-1285: Potential denial-of-service vulnerability in
  django.utils.text.Truncator HTML methods
- Fixes CVE-2026-1287: Potential SQL injection in column aliases via
  control characters
- Fixes CVE-2026-1312: Potential SQL injection via QuerySet.order_by and
  FilteredRelation
- Fixed a bug in Django 5.2 where data exceeding max_length was silently
  truncated by QuerySet.bulk_create() on PostgreSQL
- Fixed a bug where management command colorized help (introduced in Python
  3.14) ignored the --no-color option and the DJANGO_COLORS setting

* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

* Mon Dec 08 2025 Michel Lind <salimma@fedoraproject.org> - 5.2.9-1
- Update to version 5.2.9
- Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column
  aliases on PostgreSQL
- Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML
  Deserializer
- Fixes CVE-2025-64459: Potential SQL injection via _connector keyword
  argument (5.2.8)
- Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),
  alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
- Fixes CVE-2025-59682: Potential partial directory-traversal via
  archive.extract() (5.2.7)
- Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column
  aliases (5.2.6)

* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 5.2.4-4
- Rebuilt for Python 3.14.0rc3 bytecode

* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 5.2.4-3
- Rebuilt for Python 3.14.0rc2 bytecode

* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

* Mon Jul 21 2025 Michel Lind <salimma@fedoraproject.org> - 5.2.4-1
- Update to version 5.2.4
- Skip test_strip_tags and test_parsing_errors on Python 3.14; Fixes:
  RHBZ#2374042

* Mon Jul 21 2025 Python Maint <python-maint@redhat.com> - 5.2.2-3
- Unbootstrap for Python 3.14

* Wed Jun 18 2025 Python Maint <python-maint@redhat.com> - 5.2.2-2
- Bootstrap for Python 3.14.0b3 bytecode

* Mon Jun 09 2025 Michel Lind <salimma@fedoraproject.org> - 5.2.2-1
- Update to 5.2.2
- Fixes CVE-2025-32873: Denial-of-service possibility in strip_tags()
- Fixes CVE-2025-48432: Potential log injection via unescaped request path

* Tue Jun 03 2025 Python Maint <python-maint@redhat.com> - 5.1.8-4
- Bootstrap for Python 3.14

* Mon May 26 2025 Karolina Surma <ksurma@redhat.com> - 5.1.8-3
- Enable compatibility with Python 3.14+

* Wed May 14 2025 Lumir Balhar <lbalhar@redhat.com> - 5.1.8-2
- Remove upper limit from setuptools version

* Fri Apr 04 2025 Michel Lind <salimma@fedoraproject.org> - 5.1.8-1
- Update to 5.1.8
- On Windows, this fixes CVE-2025-27556. Mentioning for compleness
- Fixes a regression in Django 5.1.7 affecting
  LogEntryManager.log_actions() - #36234
- Remove legacy symlinks

* Wed Mar 19 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 5.1.7-2
- Adjust patch to allow setuptools <77

* Sat Mar 08 2025 Michel Lind <salimma@fedoraproject.org> - 5.1.7-1
- Update to version 5.1.7; Fixes: RHBZ#2350881
- Fix for CVE-2025-26699: Potential denial-of-service vulnerability in
  django.utils.text.wrap()

* Sat Feb 15 2025 Michel Lind <salimma@fedoraproject.org> - 5.1.6-1
- Initial package; Resolves: RHBZ#2345877