Back Linuxsecurity openSUSE SLE-15-SP6 Python-Django SQL Injection Vulnerability 2026-0037
This update for python-Django fixes the following issues: - CVE-2026-1312: Fixed potential SQL injection via QuerySet.order_by and FilteredRelation (bsc#1257408). - CVE-2026-1287: Fixed potential SQL injection in column aliases via control characters (bsc#1257407). - CVE-2026-1207: Fixed potential SQL injection via raster lookups on PostGIS (bsc#1257405). - CVE-2026-1285: Fixed potential denial-of-service in django.utils.text.Truncator HTML methods (bsc#1257406). - CVE-2025-13473: Fixed username enumeration through timing difference in mod_wsgi authentication handler (bsc#1257401).
Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2026-37=1
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2026-37=1
- openSUSE Backports SLE-15-SP6 (noarch): python3-Django-2.2.28-bp156.30.1
- openSUSE Backports SLE-15-SP6 (noarch):
python3-Django-2.2.28-bp156.30.1
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
