[Git][security-tracker-team/security-tracker][master] Add initial tracking for python-django issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3d8530a9 by Salvatore Bonaccorso at 2026-11-03T22:31:12+01:00
Add initial tracking for python-django issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,21 @@
+CVE-2026-108147 [Potential memory exhaustion in MultiPartParser via base64-encoded file upload]
+	- python-django <unfixed> (bug #1152952)
+	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+CVE-2026-111211 [Potential log injection via unescaped geometry form values]
+	- python-django <unfixed> (bug #1152952)
+	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+CVE-2026-111362 [Server-side request forgery via crs member of GeoJSON geometries]
+	- python-django <unfixed> (bug #1152952)
+	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+CVE-2026-113593 [Potential exposure of private data via empty and missing Vary headers]
+	- python-django <unfixed> (bug #1152952)
+	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+CVE-2026-113733 [Password hash disclosure to "view only" admin users with custom user models]
+	- python-django <unfixed> (bug #1152952)
+	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+CVE-2026-114582 [Server-side request forgery via SpatialReference string input]
+	- python-django <unfixed> (bug #1152952)
+	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
 CVE-2026-XXXX [GHSA-w3p9-g4p2-h3rr: phpseclib unbounded PBKDF iteration count in encrypted key/PFX/CMS parsing enables CPU-exhaustion DoS]
 	- php-phpseclib4 4.0.3-1
 	- php-phpseclib3 3.0.58-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d8530a9e4c4edcd7bb6bd8ca03ef1f225a94867

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d8530a9e4c4edcd7bb6bd8ca03ef1f225a94867
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261103/cb6c5d3b/attachment.htm>