CVE-2025-48432 was announced here: https://www.openwall.com/lists/oss-security/2025/06/04/5 Upstream fix for version 4.2, which may need to be backported for Mageia 9: https://github.com/django/django/commit/ac03c5e7df8680c61cdb0d3bdb8be9095dba841e
Whiteboard: (none) => MGA9TOOStatus comment: (none) => Fixed upstream in 5.1.10 and patch available from upstreamCVE: (none) => CVE-2025-48432Source RPM: (none) => python-django-5.1.9-1.mga10.src.rpm, python-django-4.1.13-1.4.mga9.src.rpm
Ubuntu has issued an advisory on June 4: https://ubuntu.com/security/notices/USN-7555-1
Assigning to thr python stack maintainers
Assignee: bugsquad => pythonCC: (none) => marja11
From https://www.openwall.com/lists/oss-security/2025/06/10/2, the fix for 4.2.x is: https://github.com/django/django/commit/b597d46bb19c8567615e62029210dab16c70db7d/
Fedora has issued an advisory on June 17: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVFOPDCA45B4XTMYRHQUSJ7JCA56453W/
Suggested advisory: ======================== The updated package fixes a security vulnerability: Potential log injection via unescaped request path. (CVE-2025-48432) References: https://www.openwall.com/lists/oss-security/2025/06/04/5 https://www.openwall.com/lists/oss-security/2025/06/10/2 https://ubuntu.com/security/notices/USN-7555-1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVFOPDCA45B4XTMYRHQUSJ7JCA56453W/ ======================== Updated package in core/updates_testing: ======================== python3-django-4.1.13-1.5.mga9 from SRPM: python-django-4.1.13-1.5.mga9.src.rpm
Whiteboard: MGA9TOO => (none)Status comment: Fixed upstream in 5.1.10 and patch available from upstream => (none)Source RPM: python-django-5.1.9-1.mga10.src.rpm, python-django-4.1.13-1.4.mga9.src.rpm => python-django-4.1.13-1.4.mga9.src.rpmStatus: NEW => ASSIGNEDVersion: Cauldron => 9Assignee: python => qa-bugs
MGA9-64 server Plasma Wayland on Compaq H000SB No installation issues. [tester9@mach3 Documents]$ django-admin startproject mysite [tester9@mach3 Documents]$ ls airco/ expat/ libxml/ rss_4.1_1.rdf server.js testcups.pdf testtransfig.gif volkstuintjes/ bugs/ firefox.exe man_nmap_ru.txt rss_5.3_1.rdf soup.txt testpoppler/ testtransfig.pdf xlst/ dcmtk.txt Frans-Bruynseelspad.pdf mysite/ rss_7_1.rdf soup.txt.gpg testtexstudio.log testtransfig.png django/ httpd.conf php/ rss_8_1.rdf soup.txt.orig testtexstudio.tex testtransfig.ps erlang/ libcaptest/ qa/ ruby/ sqlit/ testtransfig.fig testtransfig.tex [tester9@mach3 Documents]$ tree mysite mysite ├── manage.py └── mysite ├── asgi.py ├── __init__.py ├── settings.py ├── urls.py └── wsgi.py 2 directories, 6 files [tester9@mach3 Documents]$ cd mysite/ [tester9@mach3 mysite]$ python manage.py migrate Operations to perform: Apply all migrations: admin, auth, contenttypes, sessions Running migrations: Applying contenttypes.0001_initial... OK Applying auth.0001_initial... OK Applying admin.0001_initial... OK Applying admin.0002_logentry_remove_auto_add... OK Applying admin.0003_logentry_add_action_flag_choices... OK Applying contenttypes.0002_remove_content_type_name... OK Applying auth.0002_alter_permission_name_max_length... OK Applying auth.0003_alter_user_email_max_length... OK Applying auth.0004_alter_user_username_opts... OK Applying auth.0005_alter_user_last_login_null... OK Applying auth.0006_require_contenttypes_0002... OK Applying auth.0007_alter_validators_add_error_messages... OK Applying auth.0008_alter_user_username_max_length... OK Applying auth.0009_alter_user_last_name_max_length... OK Applying auth.0010_alter_group_name_max_length... OK Applying auth.0011_update_proxy_permissions... OK Applying auth.0012_alter_user_first_name_max_length... OK Applying sessions.0001_initial... OK [tester9@mach3 mysite]$ python manage.py runserver Watching for file changes with StatReloader Performing system checks... System check identified no issues (0 silenced). June 24, 2025 - 14:07:02 Django version 4.1.13, using settings 'mysite.settings' Starting development server at http://127.0.0.1:8000/ Quit the server with CONTROL-C. I could visit the page, see its little rocket and links to documentation etc... OK for me.
CC: (none) => herman.viaeneWhiteboard: (none) => MGA9-64-OK
Keywords: (none) => advisoryCC: (none) => andrewsfarm
Validating.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2025-0193.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED