Date: Thu, 2 Oct 2025 23:17:49 GMT From: Wen Heping <wen@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 6308a7fe250c - main - security/vuxml: Document Django's multiple vulnerabilities Message-ID: <202510022317.592NHnbc061900@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by wen: URL: https://cgit.FreeBSD.org/ports/commit/?id=6308a7fe250c1719f91537838474c13df85c7ac8 commit 6308a7fe250c1719f91537838474c13df85c7ac8 Author: Wen Heping <wen@FreeBSD.org> AuthorDate: 2025-10-02 23:16:01 +0000 Commit: Wen Heping <wen@FreeBSD.org> CommitDate: 2025-10-02 23:17:17 +0000 security/vuxml: Document Django's multiple vulnerabilities --- security/vuxml/vuln/2025.xml | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 48a7c5fdc5be..57c9b5c063fe 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,43 @@ + <vuln vid="90fc859e-9fe4-11f0-9fa2-080027836e8b"> + <topic>Django -- multiple vulnerabilities</topic> + <affects> + <package> + <name>py39-django42</name> + <name>py310-django42</name> + <name>py311-django42</name> + <range><lt>4.2.25</lt></range> + </package> + <package> + <name>py310-django51</name> + <name>py311-django51</name> + <range><lt>5.1.13</lt></range> + </package> + <package> + <name>py310-django52</name> + <name>py311-django52</name> + <range><lt>5.2.7</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Django reports:</p> + <blockquote cite="https://www.djangoproject.com/weblog/2025/oct/01/security-releases/">; + <p>CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB.</p> + <p>CVE-2025-59682: Potential partial directory-traversal via archive.extract().</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2025-59681</cvename> + <cvename>CVE-2025-59682</cvename> + <url>https://www.djangoproject.com/weblog/2025/oct/01/security-releases/</url>; + </references> + <dates> + <discovery>2025-10-01</discovery> + <entry>2025-10-02</entry> + </dates> + </vuln> + <vuln vid="cb570d6f-9ea9-11f0-9446-f02f7497ecda"> <topic>py-mysql-connector-python -- Vulnerability in the MySQL Connectors product of Oracle MySQL</topic> <affects>home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202510022317.592NHnbc061900>