Haixiao Yan 9757d0151b python3-django: fix CVE-2025-59681
QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and
QuerySet.extra() methods were subject to SQL injection in column aliases, using
a suitably crafted dictionary, with dictionary expansion, as the **kwargs
passed to these methods on MySQL and MariaDB.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-59681

Upstream-patch:
38d9ef8c7b

Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-04-15 14:12:18 +05:30
..
2023-02-18 13:19:36 -08:00
2024-04-07 08:36:34 -07:00
2023-06-07 09:31:32 -07:00
2024-03-04 08:56:51 -08:00
2025-04-26 15:50:27 -04:00
2023-06-05 09:29:34 -07:00
2024-02-19 23:22:24 -08:00
2025-04-26 15:50:27 -04:00