git: 23a1f766e3ff - main - security/vuxml: Document py-djangorestframework vulnerabilities
Kai Knoblich <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.ports |
|---|---|
| Message-ID | <[email protected]> |
The branch main has been updated by kai: URL: https://cgit.FreeBSD.org/ports/commit/?id=23a1f766e3ff1d90921e357487dea77594e650a3 commit 23a1f766e3ff1d90921e357487dea77594e650a3 Author: Kai Knoblich <[email protected]> AuthorDate: 2026-08-07 07:25:06 +0000 Commit: Kai Knoblich <[email protected]> CommitDate: 2026-08-07 07:25:06 +0000 security/vuxml: Document py-djangorestframework vulnerabilities --- security/vuxml/vuln/2026.xml | 45 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index 51bc9514570f..582fd4ad75b8 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,48 @@ + <vuln vid="5ce58e67-919a-11f1-b333-901b0edee044"> + <topic>py-djangorestframework -- two vulnerabilities</topic> + <affects> + <package> + <name>py310-djangorestframework</name> + <name>py311-djangorestframework</name> + <name>py312-djangorestframework</name> + <name>py313-djangorestframework</name> + <name>py313t-djangorestframework</name> + <name>py314-djangorestframework</name> + <name>py314t-djangorestframework</name> + <name>py315-djangorestframework</name> + <range><lt>3.17.2,1</lt></range> + </package> + <package> + <name>py312-dj60-djangorestframework</name> + <name>py313-dj60-djangorestframework</name> + <name>py313t-dj60-djangorestframework</name> + <name>py314-dj60-djangorestframework</name> + <name>py314t-dj60-djangorestframework</name> + <name>py315-dj60-djangorestframework</name> + <range><lt>3.17.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Bruno Alla reports:</p> + <blockquote cite="https://github.com/encode/django-rest-framework/releases/tag/3.17.2"> + <ul> + <li>Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`</li> + <li>AdminRenderer may disclose GET-protected data when rendering invalid write requests</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>https://github.com/encode/django-rest-framework/security/advisories/GHSA-2m8g-3cmr-wg3w</url> + <url>https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2</url> + </references> + <dates> + <discovery>2026-08-05</discovery> + <entry>2026-08-07</entry> + </dates> + </vuln> + <vuln vid="e1208b90-91c3-11f1-a0bc-3c7c3fba4204"> <topic>Keycloak -- multiple vulnerabilities</topic> <affects>