mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-04-18 23:36:24 +00:00
9757d0151b
QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and
QuerySet.extra() methods were subject to SQL injection in column aliases, using
a suitably crafted dictionary, with dictionary expansion, as the **kwargs
passed to these methods on MySQL and MariaDB.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-59681
Upstream-patch:
38d9ef8c7b
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
19 lines
589 B
BlitzBasic
19 lines
589 B
BlitzBasic
require python-django.inc
|
|
inherit setuptools3
|
|
|
|
# Windows-specific DoS via NFKC normalization, not applicable to Linux
|
|
CVE_STATUS[CVE-2025-27556] = "not-applicable-platform: Issue only applies on Windows"
|
|
|
|
SRC_URI += "file://CVE-2025-64460.patch \
|
|
file://CVE-2025-64459-1.patch \
|
|
file://CVE-2025-64459-2.patch \
|
|
file://CVE-2025-57833.patch \
|
|
file://CVE-2025-59681.patch \
|
|
"
|
|
SRC_URI[sha256sum] = "29019a5763dbd48da1720d687c3522ef40d1c61be6fb2fad27ed79e9f655bc11"
|
|
|
|
RDEPENDS:${PN} += "\
|
|
python3-sqlparse \
|
|
python3-asgiref \
|
|
"
|