[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAN+fQHzDjwHONmFdu17_O-SkiG1i3Z637i-6EsJnnq4rd9HrWg@mail.gmail.com>
Date: Tue, 10 Jun 2025 15:28:34 +0200
From: Sarah Boyce <sarahboyce@...ngoproject.com>
To: oss-security@...ts.openwall.com
Cc: Django Security Team <security@...ngoproject.com>
Subject: Django CVE-2025-48432 (follow-up patch releases)
https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
Following the June 4, 2025 security release, the Django team is issuing
releases for
`Django 5.2.3 <https://docs.djangoproject.com/en/dev/releases/5.2.3/>`_,
`Django 5.1.11 <https://docs.djangoproject.com/en/dev/releases/5.1.11/>`_,
and
`Django 4.2.23 <https://docs.djangoproject.com/en/dev/releases/4.2.23/>`_ to
complete mitigation for CVE-2025-48432: Potential log injection via
unescaped
request path (`full description <
https://www.djangoproject.com/weblog/2025/jun/04/security-releases/>`_).
These follow-up releases migrate remaining response logging paths to a safer
logging implementation, ensuring that all untrusted input is properly
escaped
before being written to logs. This update does not introduce a new CVE but
strengthens the original fix.
We encourage all users of Django to upgrade as soon as possible.
Affected supported versions
===========================
* Django main
* Django 5.2
* Django 5.1
* Django 4.2
Resolution
==========
Patches to resolve the issue have been applied to Django's
main, 5.2, 5.1, and 4.2 branches.
The patches may be obtained from the following changesets.
CVE-2025-48432: Potential log injection via unescaped request path
------------------------------------------------------------------
* On the `main branch <
https://github.com/django/django/commit/957951755259b412d5113333b32bf85871d29814/
>`__
* On the `5.2 branch <
https://github.com/django/django/commit/8fcc83953c350e158a484bf1da0aa1b79b69bb07/
>`__
* On the `5.1 branch <
https://github.com/django/django/commit/31f4bd31fa16f7f5302f65b9b8b7a49b69a7c4a6/
>`__
* On the `4.2 branch <
https://github.com/django/django/commit/b597d46bb19c8567615e62029210dab16c70db7d/
>`__
The following releases have been issued
=======================================
* Django 5.2.3 (`download Django 5.2.3
<https://www.djangoproject.com/download/5.2.3/tarball/>`_ |
`5.2.3 checksums
<https://www.djangoproject.com/download/5.2.3/checksum/>`_)
* Django 5.1.11 (`download Django 5.1.11
<https://www.djangoproject.com/download/5.1.11/tarball/>`_ |
`5.1.11 checksums
<https://www.djangoproject.com/download/5.1.11/checksum/>`_)
* Django 4.2.23 (`download Django 4.2.23
<https://www.djangoproject.com/download/4.2.23/tarball/>`_ |
`4.2.23 checksums
<https://www.djangoproject.com/download/4.2.23/checksum/>`_)
The PGP key ID used for this release is : `3955B19851EA96EF <
https://github.com/sarahboyce.gpg>`_
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
