OESA-2026-1506

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1506
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-1506.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2026-1506
Upstream
Published
2026-03-06T12:41:36Z
Modified
2026-03-11T07:15:50.456823Z
Summary
python-django security update
Details

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary umask change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-25674)

Database specific 
{
    "severity": "Low"
}
References

Affected packages

openEuler:24.03-LTS-SP3 / python-django

Package

Name
python-django
Purl
pkg:rpm/openEuler/python-django&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.15-13.oe2403sp3

Ecosystem specific 

{
    "noarch": [
        "python-django-help-4.2.15-13.oe2403sp3.noarch.rpm",
        "python3-Django-4.2.15-13.oe2403sp3.noarch.rpm"
    ],
    "src": [
        "python-django-4.2.15-13.oe2403sp3.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1506.json"