summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-python/recipes-devtools/python/python3-django-3.2.25/CVE-2025-26699.patch106
-rw-r--r--meta-python/recipes-devtools/python/python3-django/CVE-2025-26699.patch107
-rw-r--r--meta-python/recipes-devtools/python/python3-django_2.2.28.bb1
-rw-r--r--meta-python/recipes-devtools/python/python3-django_3.2.25.bb3
4 files changed, 217 insertions, 0 deletions
diff --git a/meta-python/recipes-devtools/python/python3-django-3.2.25/CVE-2025-26699.patch b/meta-python/recipes-devtools/python/python3-django-3.2.25/CVE-2025-26699.patch
new file mode 100644
index 0000000000..21845e9ab5
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-django-3.2.25/CVE-2025-26699.patch
@@ -0,0 +1,106 @@
1From e88f7376fe68dbf4ebaf11fad1513ce700b45860 Mon Sep 17 00:00:00 2001
2From: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
3Date: Tue, 25 Feb 2025 09:40:54 +0100
4Subject: [PATCH] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap
5 template filter.
6
7Thanks sw0rd1ight for the report.
8
9Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.
10
11CVE: CVE-2025-26699
12
13Upstream-Status: Backport
14https://github.com/django/django/commit/e88f7376fe68dbf4ebaf11fad1513ce700b45860
15
16Signed-off-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
17Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
18---
19 django/utils/text.py | 27 +++++++------------
20 docs/releases/3.2.25.txt | 6 +++++
21 .../filter_tests/test_wordwrap.py | 11 ++++++++
22 3 files changed, 27 insertions(+), 17 deletions(-)
23
24diff --git a/django/utils/text.py b/django/utils/text.py
25index 88da9a2..cabd76f 100644
26--- a/django/utils/text.py
27+++ b/django/utils/text.py
28@@ -1,5 +1,6 @@
29 import html.entities
30 import re
31+import textwrap
32 import unicodedata
33 import warnings
34 from gzip import GzipFile
35@@ -91,23 +92,15 @@ def wrap(text, width):
36 Don't wrap long words, thus the output text may have lines longer than
37 ``width``.
38 """
39- def _generator():
40- for line in text.splitlines(True): # True keeps trailing linebreaks
41- max_width = min((line.endswith('\n') and width + 1 or width), width)
42- while len(line) > max_width:
43- space = line[:max_width + 1].rfind(' ') + 1
44- if space == 0:
45- space = line.find(' ') + 1
46- if space == 0:
47- yield line
48- line = ''
49- break
50- yield '%s\n' % line[:space - 1]
51- line = line[space:]
52- max_width = min((line.endswith('\n') and width + 1 or width), width)
53- if line:
54- yield line
55- return ''.join(_generator())
56+ wrapper = textwrap.TextWrapper(
57+ width=width,
58+ break_long_words=False,
59+ break_on_hyphens=False,
60+ )
61+ result = []
62+ for line in text.splitlines(True):
63+ result.extend(wrapper.wrap(line))
64+ return "\n".join(result)
65
66
67 class Truncator(SimpleLazyObject):
68diff --git a/docs/releases/3.2.25.txt b/docs/releases/3.2.25.txt
69index a3a9098..f8d9ce2 100644
70--- a/docs/releases/3.2.25.txt
71+++ b/docs/releases/3.2.25.txt
72@@ -15,6 +15,12 @@ CVE-2024-27351: Potential regular expression denial-of-service in ``django.utils
73 regular expression denial-of-service attack using a suitably crafted string
74 (follow up to :cve:`2019-14232` and :cve:`2023-43665`).
75
76+CVE-2025-26699: Potential denial-of-service vulnerability in ``django.utils.text.wrap()``
77+=========================================================================================
78+
79+The ``wrap()`` and :tfilter:`wordwrap` template filter were subject to a
80+potential denial-of-service attack when used with very long strings.
81+
82 Bugfixes
83 ========
84
85diff --git a/tests/template_tests/filter_tests/test_wordwrap.py b/tests/template_tests/filter_tests/test_wordwrap.py
86index 02f8605..f61842c 100644
87--- a/tests/template_tests/filter_tests/test_wordwrap.py
88+++ b/tests/template_tests/filter_tests/test_wordwrap.py
89@@ -51,3 +51,14 @@ class FunctionTests(SimpleTestCase):
90 ), 14),
91 'this is a long\nparagraph of\ntext that\nreally needs\nto be wrapped\nI\'m afraid',
92 )
93+
94+ def test_wrap_long_text(self):
95+ long_text = (
96+ "this is a long paragraph of text that really needs"
97+ " to be wrapped I'm afraid " * 20_000
98+ )
99+ self.assertIn(
100+ "this is a\nlong\nparagraph\nof text\nthat\nreally\nneeds to\nbe wrapped\n"
101+ "I'm afraid",
102+ wordwrap(long_text, 10),
103+ )
104--
1052.40.0
106
diff --git a/meta-python/recipes-devtools/python/python3-django/CVE-2025-26699.patch b/meta-python/recipes-devtools/python/python3-django/CVE-2025-26699.patch
new file mode 100644
index 0000000000..44e182057a
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-django/CVE-2025-26699.patch
@@ -0,0 +1,107 @@
1From e88f7376fe68dbf4ebaf11fad1513ce700b45860 Mon Sep 17 00:00:00 2001
2From: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
3Date: Tue, 25 Feb 2025 09:40:54 +0100
4Subject: [PATCH] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap
5 template filter.
6
7Thanks sw0rd1ight for the report.
8
9Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.
10
11CVE: CVE-2025-26699
12
13Upstream-Status: Backport
14https://github.com/django/django/commit/e88f7376fe68dbf4ebaf11fad1513ce700b45860
15
16Signed-off-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
17Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
18
19%% original patch: CVE-2025-26699.patch
20---
21 django/utils/text.py | 28 ++++++++-----------
22 docs/releases/2.2.28.txt | 6 ++++
23 .../filter_tests/test_wordwrap.py | 12 ++++++++
24 3 files changed, 29 insertions(+), 17 deletions(-)
25
26diff --git a/django/utils/text.py b/django/utils/text.py
27index 2c4040e..c474d56 100644
28--- a/django/utils/text.py
29+++ b/django/utils/text.py
30@@ -1,5 +1,6 @@
31 import html.entities
32 import re
33+import textwrap
34 import unicodedata
35 from gzip import GzipFile
36 from io import BytesIO
37@@ -88,23 +89,16 @@ def wrap(text, width):
38 Don't wrap long words, thus the output text may have lines longer than
39 ``width``.
40 """
41- def _generator():
42- for line in text.splitlines(True): # True keeps trailing linebreaks
43- max_width = min((line.endswith('\n') and width + 1 or width), width)
44- while len(line) > max_width:
45- space = line[:max_width + 1].rfind(' ') + 1
46- if space == 0:
47- space = line.find(' ') + 1
48- if space == 0:
49- yield line
50- line = ''
51- break
52- yield '%s\n' % line[:space - 1]
53- line = line[space:]
54- max_width = min((line.endswith('\n') and width + 1 or width), width)
55- if line:
56- yield line
57- return ''.join(_generator())
58+
59+ wrapper = textwrap.TextWrapper(
60+ width=width,
61+ break_long_words=False,
62+ break_on_hyphens=False,
63+ )
64+ result = []
65+ for line in text.splitlines(True):
66+ result.extend(wrapper.wrap(line))
67+ return "\n".join(result)
68
69
70 class Truncator(SimpleLazyObject):
71diff --git a/docs/releases/2.2.28.txt b/docs/releases/2.2.28.txt
72index 7227452..7096d13 100644
73--- a/docs/releases/2.2.28.txt
74+++ b/docs/releases/2.2.28.txt
75@@ -99,3 +99,9 @@ CVE-2024-27351: Potential regular expression denial-of-service in ``django.utils
76 regular expression denial-of-service attack using a suitably crafted string
77 (follow up to :cve:`2019-14232` and :cve:`2023-43665`).
78
79+CVE-2025-26699: Potential denial-of-service vulnerability in ``django.utils.text.wrap()``
80+=========================================================================================
81+
82+The ``wrap()`` and :tfilter:`wordwrap` template filter were subject to a
83+potential denial-of-service attack when used with very long strings.
84+
85diff --git a/tests/template_tests/filter_tests/test_wordwrap.py b/tests/template_tests/filter_tests/test_wordwrap.py
86index 02f8605..e6f2afb 100644
87--- a/tests/template_tests/filter_tests/test_wordwrap.py
88+++ b/tests/template_tests/filter_tests/test_wordwrap.py
89@@ -51,3 +51,15 @@ class FunctionTests(SimpleTestCase):
90 ), 14),
91 'this is a long\nparagraph of\ntext that\nreally needs\nto be wrapped\nI\'m afraid',
92 )
93+
94+ def test_wrap_long_text(self):
95+ long_text = (
96+ "this is a long paragraph of text that really needs"
97+ " to be wrapped I'm afraid " * 20_000
98+ )
99+ self.assertIn(
100+ "this is a\nlong\nparagraph\nof text\nthat\nreally\nneeds to\nbe wrapped\n"
101+ "I'm afraid",
102+ wordwrap(long_text, 10),
103+ )
104+
105--
1062.40.0
107
diff --git a/meta-python/recipes-devtools/python/python3-django_2.2.28.bb b/meta-python/recipes-devtools/python/python3-django_2.2.28.bb
index f394397453..24eee95f03 100644
--- a/meta-python/recipes-devtools/python/python3-django_2.2.28.bb
+++ b/meta-python/recipes-devtools/python/python3-django_2.2.28.bb
@@ -25,6 +25,7 @@ SRC_URI += "file://CVE-2023-31047.patch \
25 file://CVE-2024-45231.patch \ 25 file://CVE-2024-45231.patch \
26 file://CVE-2024-53907.patch \ 26 file://CVE-2024-53907.patch \
27 file://CVE-2024-27351.patch \ 27 file://CVE-2024-27351.patch \
28 file://CVE-2025-26699.patch \
28 " 29 "
29 30
30SRC_URI[sha256sum] = "0200b657afbf1bc08003845ddda053c7641b9b24951e52acd51f6abda33a7413" 31SRC_URI[sha256sum] = "0200b657afbf1bc08003845ddda053c7641b9b24951e52acd51f6abda33a7413"
diff --git a/meta-python/recipes-devtools/python/python3-django_3.2.25.bb b/meta-python/recipes-devtools/python/python3-django_3.2.25.bb
index 29977fa013..fb6cb97710 100644
--- a/meta-python/recipes-devtools/python/python3-django_3.2.25.bb
+++ b/meta-python/recipes-devtools/python/python3-django_3.2.25.bb
@@ -6,6 +6,9 @@ SRC_URI[sha256sum] = "7ca38a78654aee72378594d63e51636c04b8e28574f5505dff630895b5
6RDEPENDS:${PN} += "\ 6RDEPENDS:${PN} += "\
7 ${PYTHON_PN}-sqlparse \ 7 ${PYTHON_PN}-sqlparse \
8" 8"
9SRC_URI += "\
10 file://CVE-2025-26699.patch \
11"
9 12
10# Set DEFAULT_PREFERENCE so that the LTS version of django is built by 13# Set DEFAULT_PREFERENCE so that the LTS version of django is built by
11# default. To build the 3.x branch, 14# default. To build the 3.x branch,
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-14 19:38:01 +0000