mirror of
https://github.com/django/django.git
synced 2025-10-09 14:59:24 +00:00
Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.
18 lines
802 B
Plaintext
18 lines
802 B
Plaintext
===========================
|
|
Django 4.2.25 release notes
|
|
===========================
|
|
|
|
*October 1, 2025*
|
|
|
|
Django 4.2.25 fixes one security issue with severity "high" and one security
|
|
issue with severity "low" in 4.2.24.
|
|
|
|
CVE-2025-59681: Potential SQL injection in ``QuerySet.annotate()``, ``alias()``, ``aggregate()``, and ``extra()`` on MySQL and MariaDB
|
|
======================================================================================================================================
|
|
|
|
:meth:`.QuerySet.annotate`, :meth:`~.QuerySet.alias`,
|
|
:meth:`~.QuerySet.aggregate`, and :meth:`~.QuerySet.extra` methods were subject
|
|
to SQL injection in column aliases, using a suitably crafted dictionary, with
|
|
dictionary expansion, as the ``**kwargs`` passed to these methods (follow up to
|
|
:cve:`2022-28346`).
|