[Git][security-tracker-team/security-tracker][master] Add upstream commit references for python-django issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
655c4435 by Salvatore Bonaccorso at 2026-02-03T20:59:37+01:00
Add upstream commit references for python-django issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,21 +1,27 @@
 CVE-2026-1312 [Potential SQL injection via QuerySet.order_by and FilteredRelation]
 	- python-django <unfixed>
 	NOTE: https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/90f5b10784ba5bf369caed87640e2b4394ea3314 (4.2.28)
 CVE-2026-1287 [Potential SQL injection in column aliases via control characters]
 	- python-django <unfixed>
 	NOTE: https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/f75f8f3597e1ce351d5ac08b6ba7ebd9dadd9b5d (4.2.28)
 CVE-2026-1285 [Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods]
 	- python-django <unfixed>
 	NOTE: https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/b40cfc6052ced26dcd8166a58ea6f841d0d2cac8 (4.2.28)
 CVE-2026-1207 [Potential SQL injection via raster lookups on PostGIS]
 	- python-django <unfixed>
 	NOTE: https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/a14363102d98fa29b8cced578eb3a0fadaa5bcb7 (4.2.28)
 CVE-2025-14550 [Potential denial-of-service vulnerability via repeated headers when using ASGI]
 	- python-django <unfixed>
 	NOTE: https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/f578acc8c54530fffabd52d2db654c8669b011af (4.2.28)
 CVE-2025-13473 [Username enumeration through timing difference in mod_wsgi authentication handler]
 	- python-django <unfixed>
 	NOTE: https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/6dc23508f3395e1254c315084c7334ef81c4c09a (4.2.28)
 CVE-2026-25228 (Signal K Server is a server application that runs on a central hub in  ...)
 	NOT-FOR-US: Signal K Server
 CVE-2026-25222 (PolarLearn is a free and open-source learning program. In 0-PRERELEASE ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/655c443503ff246201d603180e4d15d68d2bb66a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/655c443503ff246201d603180e4d15d68d2bb66a
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260203/989c0e15/attachment.htm>