MGASA-2026-0032

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0032.html
Import Source
https://advisories.mageia.org/MGASA-2026-0032.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2026-0032
Upstream
Published
2026-02-06T05:11:54Z
Modified
2026-04-16T00:10:21Z
Summary
Updated python-django packages fix security vulnerabilities
Details

Username enumeration through timing difference in mod_wsgi authentication handler. (CVE-2025-13473) Potential denial-of-service vulnerability via repeated headers when using ASGI. (CVE-2025-14550) Potential SQL injection via raster lookups on PostGIS. (CVE-2026-1207) Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods. (CVE-2026-1285) Potential SQL injection in column aliases via control characters. (CVE-2026-1287) Potential SQL injection via QuerySet.order_by and FilteredRelation. (CVE-2026-1312)

References
Credits

Affected packages

Mageia:9 / python-django

Package

Name
python-django
Purl
pkg:rpm/mageia/python-django?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.1.13-1.10.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0032.json"