From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Michel Lind To: git-commits@fedoraproject.org Subject: [rpms/python-django4.2] epel9: Backport fix for CVE-2026-35192 (low): Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST Date: Sat, 06 Jun 2026 17:34:38 GMT Message-ID: <178076727824.1.9273745047371242818.rpms-python-django4.2-0fb45c56eca0@fedoraproject.org> List-ID: X-Git-Repo: rpms/python-django4.2 X-Git-Branch: epel9 X-Git-Rev: 0fb45c56eca060e84cf4b776044e7a2389246ea3 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvcHl0aG9uLWRqYW5nbzQuMgogICAgICAgICAgICBCcmFuY2ggOiBlcGVsOQog ICAgICAgICAgICBDb21taXQgOiAwZmI0NWM1NmVjYTA2MGU4NGNmNGI3NzYwNDRlN2EyMzg5MjQ2 ZWEzCiAgICAgICAgICAgIEF1dGhvciA6IE1pY2hlbCBMaW5kIDxzYWxpbW1hQGZlZG9yYXByb2pl Y3Qub3JnPgogICAgICAgICAgICBEYXRlICAgOiAyMDI2LTA2LTA2VDE4OjI5OjQ4KzAxOjAwCiAg ICAgICAgICAgIFN0YXRzICA6ICs5Ni8tMCBpbiAzIGZpbGUocykKICAgICAgICAgICAgVVJMICAg IDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9weXRob24tZGphbmdvNC4yL2Mv MGZiNDVjNTZlY2EwNjBlODRjZjRiNzc2MDQ0ZTdhMjM4OTI0NmVhMz9icmFuY2g9ZXBlbDkKCiAg ICAgICAgICAgIExvZzoKICAgICAgICAgICAgQmFja3BvcnQgZml4IGZvciBDVkUtMjAyNi0zNTE5 MiAobG93KTogU2Vzc2lvbiBmaXhhdGlvbiB2aWEgcHVibGljIGNhY2hlZCBwYWdlcyBhbmQgU0VT U0lPTl9TQVZFX0VWRVJZX1JFUVVFU1QKClNpZ25lZC1vZmYtYnk6IE1pY2hlbCBMaW5kIDxzYWxp bW1hQGZlZG9yYXByb2plY3Qub3JnPgoKLS0tCmRpZmYgLS1naXQgYS9iYWNrcG9ydC1DVkUtMjAy Ni0zNTE5Mi5kaWZmIGIvYmFja3BvcnQtQ1ZFLTIwMjYtMzUxOTIuZGlmZgpuZXcgZmlsZSBtb2Rl IDEwMDY0NAppbmRleCAwMDAwMDAwLi40NTY4M2ZhCi0tLSAvZGV2L251bGwKKysrIGIvYmFja3Bv cnQtQ1ZFLTIwMjYtMzUxOTIuZGlmZgpAQCAtMCwwICsxLDkyIEBACitGcm9tIDQ3Y2Y5NjhjMTI1 ZTNmYWIzMTdlMTBmZTE1MGVjNDc5ZTc0NWY5OTUgTW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCitG cm9tOiBKYWtlIEhvd2FyZCA8Z2l0QHRoZW9yYW5nZW9uZS5uZXQ+CitEYXRlOiBXZWQsIDEgQXBy IDIwMjYgMTg6MjE6MzAgKzAyMDAKK1N1YmplY3Q6IFtQQVRDSF0gWzUuMi54XSBGaXhlZCBDVkUt MjAyNi0zNTE5MiAtLSBFbnN1cmVkIFZhcnkgaGVhZGVyIGlzIHNlbnQKKyB3aGVuIHNldHRpbmcg c2Vzc2lvbiBjb29raWUgd2l0aCBTRVNTSU9OX1NBVkVfRVZFUllfUkVRVUVTVD1UcnVlLgorCitU aGFuayB5b3UgSmFjb2IgV2FsbHMgYW5kIE5hdGFsaWEgQmlkYXJ0IGZvciByZXZpZXdzLgorCitC YWNrcG9ydCBvZiA3ZjZlOWI1NTEzMGQ1MTU4ODA0YzBhY2JjMGIyNGNjYjc0MjJlZDgyIGZyb20g bWFpbi4KKy0tLQorIGRqYW5nby9jb250cmliL3Nlc3Npb25zL21pZGRsZXdhcmUucHkgfCAxMSAr KysrKysrKy0tLQorIGRvY3MvcmVsZWFzZXMvNS4yLjE0LnR4dCAgICAgICAgICAgICAgfCAxMSAr KysrKysrKysrKworIHRlc3RzL3Nlc3Npb25zX3Rlc3RzL3Rlc3RzLnB5ICAgICAgICAgfCAyOCAr KysrKysrKysrKysrKysrKysrKysrKysrKysKKyAzIGZpbGVzIGNoYW5nZWQsIDQ3IGluc2VydGlv bnMoKyksIDMgZGVsZXRpb25zKC0pCisKKy0tLSBhL2RqYW5nby9jb250cmliL3Nlc3Npb25zL21p ZGRsZXdhcmUucHkKKysrKyBiL2RqYW5nby9jb250cmliL3Nlc3Npb25zL21pZGRsZXdhcmUucHkK K0BAIC00MCwxMCArNDAsMTEgQEAgY2xhc3MgU2Vzc2lvbk1pZGRsZXdhcmUoTWlkZGxld2FyZU1p eGluKQorICAgICAgICAgICAgICAgICBkb21haW49c2V0dGluZ3MuU0VTU0lPTl9DT09LSUVfRE9N QUlOLAorICAgICAgICAgICAgICAgICBzYW1lc2l0ZT1zZXR0aW5ncy5TRVNTSU9OX0NPT0tJRV9T QU1FU0lURSwKKyAgICAgICAgICAgICApCistICAgICAgICAgICAgcGF0Y2hfdmFyeV9oZWFkZXJz KHJlc3BvbnNlLCAoIkNvb2tpZSIsKSkKKysgICAgICAgICAgICBuZWVkX3ZhcnlfY29va2llID0g VHJ1ZQorICAgICAgICAgZWxzZToKKy0gICAgICAgICAgICBpZiBhY2Nlc3NlZDoKKy0gICAgICAg ICAgICAgICAgcGF0Y2hfdmFyeV9oZWFkZXJzKHJlc3BvbnNlLCAoIkNvb2tpZSIsKSkKKysgICAg ICAgICAgICAjIElmIHRoZSBzZXNzaW9uIHdhcyBhY2Nlc3NlZCwgaXQgbXVzdCBiZSB2YXJpZWQg b24sIHJlZ2FyZGxlc3Mgb2YKKysgICAgICAgICAgICAjIHdoZXRoZXIgaXQgd2FzIG1vZGlmaWVk IG9yIHdpbGwgYmUgc2F2ZWQuCisrICAgICAgICAgICAgbmVlZF92YXJ5X2Nvb2tpZSA9IGFjY2Vz c2VkCisgICAgICAgICAgICAgaWYgKG1vZGlmaWVkIG9yIHNldHRpbmdzLlNFU1NJT05fU0FWRV9F VkVSWV9SRVFVRVNUKSBhbmQgbm90IGVtcHR5OgorICAgICAgICAgICAgICAgICBpZiByZXF1ZXN0 LnNlc3Npb24uZ2V0X2V4cGlyZV9hdF9icm93c2VyX2Nsb3NlKCk6CisgICAgICAgICAgICAgICAg ICAgICBtYXhfYWdlID0gTm9uZQorQEAgLTc0LDQgKzc1LDggQEAgY2xhc3MgU2Vzc2lvbk1pZGRs ZXdhcmUoTWlkZGxld2FyZU1peGluKQorICAgICAgICAgICAgICAgICAgICAgICAgIGh0dHBvbmx5 PXNldHRpbmdzLlNFU1NJT05fQ09PS0lFX0hUVFBPTkxZIG9yIE5vbmUsCisgICAgICAgICAgICAg ICAgICAgICAgICAgc2FtZXNpdGU9c2V0dGluZ3MuU0VTU0lPTl9DT09LSUVfU0FNRVNJVEUsCisg ICAgICAgICAgICAgICAgICAgICApCisrICAgICAgICAgICAgICAgICAgICAjIFdpdGggYSBzZXNz aW9uIGNvb2tpZSBzZXQsIGl0IG11c3QgYmUgdmFyaWVkIG9uLgorKyAgICAgICAgICAgICAgICAg ICAgbmVlZF92YXJ5X2Nvb2tpZSA9IFRydWUKKysgICAgICAgIGlmIG5lZWRfdmFyeV9jb29raWU6 CisrICAgICAgICAgICAgcGF0Y2hfdmFyeV9oZWFkZXJzKHJlc3BvbnNlLCAoIkNvb2tpZSIsKSkK KyAgICAgICAgIHJldHVybiByZXNwb25zZQorLS0tIGEvdGVzdHMvc2Vzc2lvbnNfdGVzdHMvdGVz dHMucHkKKysrKyBiL3Rlc3RzL3Nlc3Npb25zX3Rlc3RzL3Rlc3RzLnB5CitAQCAtNjc2LDYgKzY3 Niw3IEBAIGNsYXNzIFNlc3Npb25NaWRkbGV3YXJlVGVzdHMoVGVzdENhc2UpOgorICAgICAgICAg IyBIYW5kbGUgdGhlIHJlc3BvbnNlIHRocm91Z2ggdGhlIG1pZGRsZXdhcmUKKyAgICAgICAgIHJl c3BvbnNlID0gbWlkZGxld2FyZShyZXF1ZXN0KQorICAgICAgICAgc2VsZi5hc3NlcnRJcyhyZXNw b25zZS5jb29raWVzW3NldHRpbmdzLlNFU1NJT05fQ09PS0lFX05BTUVdWyJzZWN1cmUiXSwgVHJ1 ZSkKKysgICAgICAgIHNlbGYuYXNzZXJ0RXF1YWwocmVzcG9uc2UuaGVhZGVyc1siVmFyeSJdLCAi Q29va2llIikKKyAKKyAgICAgQG92ZXJyaWRlX3NldHRpbmdzKFNFU1NJT05fQ09PS0lFX0hUVFBP TkxZPVRydWUpCisgICAgIGRlZiB0ZXN0X2h0dHBvbmx5X3Nlc3Npb25fY29va2llKHNlbGYpOgor QEAgLTgxNiw2ICs4MTcsNyBAQCBjbGFzcyBTZXNzaW9uTWlkZGxld2FyZVRlc3RzKFRlc3RDYXNl KToKKyAgICAgICAgICAgICApLAorICAgICAgICAgICAgIHN0cihyZXNwb25zZS5jb29raWVzW3Nl dHRpbmdzLlNFU1NJT05fQ09PS0lFX05BTUVdKSwKKyAgICAgICAgICkKKysgICAgICAgIHNlbGYu YXNzZXJ0RXF1YWwocmVzcG9uc2UuaGVhZGVyc1siVmFyeSJdLCAiQ29va2llIikKKyAKKyAgICAg ZGVmIHRlc3RfZmx1c2hfZW1wdHlfd2l0aG91dF9zZXNzaW9uX2Nvb2tpZV9kb2VzbnRfc2V0X2Nv b2tpZShzZWxmKToKKyAgICAgICAgIGRlZiByZXNwb25zZV9lbmRpbmdfc2Vzc2lvbihyZXF1ZXN0 KToKK0BAIC04MzMsNiArODM1LDMyIEBAIGNsYXNzIFNlc3Npb25NaWRkbGV3YXJlVGVzdHMoVGVz dENhc2UpOgorICAgICAgICAgIyBUaGUgc2Vzc2lvbiBpcyBhY2Nlc3NlZCBzbyAiVmFyeTogQ29v a2llIiBzaG91bGQgYmUgc2V0LgorICAgICAgICAgc2VsZi5hc3NlcnRFcXVhbChyZXNwb25zZS5o ZWFkZXJzWyJWYXJ5Il0sICJDb29raWUiKQorIAorKyAgICBAb3ZlcnJpZGVfc2V0dGluZ3MoU0VT U0lPTl9TQVZFX0VWRVJZX1JFUVVFU1Q9VHJ1ZSkKKysgICAgZGVmIHRlc3Rfc2F2ZV9ldmVyeV9y ZXF1ZXN0X3dpdGhfbm9uX2VtcHR5X3Nlc3Npb25fcmVuZXdzX3Nlc3Npb25fY29va2llKHNlbGYp OgorKyAgICAgICAgcmVxdWVzdCA9IHNlbGYucmVxdWVzdF9mYWN0b3J5LmdldCgiLyIpCisrICAg ICAgICBtaWRkbGV3YXJlID0gU2Vzc2lvbk1pZGRsZXdhcmUoc2VsZi5nZXRfcmVzcG9uc2VfdG91 Y2hpbmdfc2Vzc2lvbikKKysKKysgICAgICAgICMgTWFrZSBzdXJlIHRoZSByZXF1ZXN0IGhhcyBh IHNlc3Npb24uCisrICAgICAgICBtaWRkbGV3YXJlKHJlcXVlc3QpCisrCisrICAgICAgICAjIEEg Y29va2llIHNob3VsZCBiZSBzZXQuCisrICAgICAgICBzZWxmLmFzc2VydElzKHJlcXVlc3Quc2Vz c2lvbi5pc19lbXB0eSgpLCBGYWxzZSkKKysgICAgICAgIHNlbGYuYXNzZXJ0RXF1YWwocmVxdWVz dC5zZXNzaW9uWyJoZWxsbyJdLCAid29ybGQiKQorKworKyAgICAgICAgcmVxdWVzdC5DT09LSUVT W3NldHRpbmdzLlNFU1NJT05fQ09PS0lFX05BTUVdID0gcmVxdWVzdC5zZXNzaW9uLnNlc3Npb25f a2V5CisrCisrICAgICAgICBkZWYgc2ltcGxlX3ZpZXcocmVxdWVzdCk6CisrICAgICAgICAgICAg cmV0dXJuIEh0dHBSZXNwb25zZSgiU2Vzc2lvbiB0ZXN0IikKKysKKysgICAgICAgIG1pZGRsZXdh cmUgPSBTZXNzaW9uTWlkZGxld2FyZShzaW1wbGVfdmlldykKKysgICAgICAgIHJlc3BvbnNlID0g bWlkZGxld2FyZShyZXF1ZXN0KQorKworKyAgICAgICAgIyBBIGNvb2tpZSBzaG91bGQgYmUgc2V0 IGJlY2F1c2UgU0VTU0lPTl9TQVZFX0VWRVJZX1JFUVVFU1Q9VHJ1ZSwKKysgICAgICAgICMgZXZl biB0aG91Z2ggdGhlIHNlc3Npb24gd2Fzbid0IHRvdWNoZWQuCisrICAgICAgICBzZWxmLmFzc2Vy dEluKHNldHRpbmdzLlNFU1NJT05fQ09PS0lFX05BTUUsIHJlc3BvbnNlLmNvb2tpZXMpCisrICAg ICAgICAjIFRoZXJlJ3MgYSBzZXNzaW9uLCBzbyBhbHNvIFZhcnkgb24gaXQuCisrICAgICAgICBz ZWxmLmFzc2VydEVxdWFsKHJlc3BvbnNlLmhlYWRlcnNbIlZhcnkiXSwgIkNvb2tpZSIpCisrCisg ICAgIGRlZiB0ZXN0X2VtcHR5X3Nlc3Npb25fc2F2ZWQoc2VsZik6CisgICAgICAgICAiIiIKKyAg ICAgICAgIElmIGEgc2Vzc2lvbiBpcyBlbXB0aWVkIG9mIGRhdGEgYnV0IHN0aWxsIGhhcyBhIGtl eSwgaXQgc2hvdWxkIHN0aWxsCgpkaWZmIC0tZ2l0IGEvcHl0aG9uLWRqYW5nbzQuMi5zcGVjIGIv cHl0aG9uLWRqYW5nbzQuMi5zcGVjCmluZGV4IGU3YmZhZDguLmMxNTIwMGUgMTAwNjQ0Ci0tLSBh L3B5dGhvbi1kamFuZ280LjIuc3BlYworKysgYi9weXRob24tZGphbmdvNC4yLnNwZWMKQEAgLTM1 LDYgKzM1LDggQEAgUGF0Y2g6ICAgICAgICAgIGRqYW5nby00LjIuMjItcmV2ZXJ0LXB5cHJvamVj dC1jb252ZXJzaW9uLmRpZmYKICMgcHl0aG9uIDMuMTMgLSBhcmdwYXJzZSBjaGFuZ2UgaHR0cHM6 Ly9naXRodWIuY29tL3B5dGhvbi9jcHl0aG9uL2NvbW1pdC9jNGEyZThhMmM1MTg4YzMyODhkNTdi ODA4NTJlOTJjODNmNDZmNmYzCiAjIGJhY2twb3J0IChmdXp6ZWQgcGF0Y2gpIGZvciBodHRwczov L2dpdGh1Yi5jb20vZGphbmdvL2RqYW5nby9jb21taXQvMzQyNmE1YzMzYzM2MjY2YWY0MjEyOGVl OWVjYTQ5MjFlNjhlYTg3Ni5wYXRjaAogUGF0Y2g6ICAgICAgICAgIGJhY2twb3J0LTM0MjZhNWMz M2MzNjI2NmFmNDIxMjhlZTllY2E0OTIxZTY4ZWE4NzYucGF0Y2gKKyMgYmFja3BvcnQgKGZ1enpl ZCBwYXRjaCkgZm9yIENWRS0yMDI2LTM1MTkyIGZyb20gaHR0cHM6Ly9naXRodWIuY29tL2RqYW5n by9kamFuZ28vY29tbWl0LzQ3Y2Y5NjhjMTI1ZTNmYWIzMTdlMTBmZTE1MGVjNDc5ZTc0NWY5OTUK K1BhdGNoOiAgICAgICAgICBiYWNrcG9ydC1DVkUtMjAyNi0zNTE5Mi5kaWZmCiAjIHNraXAgZmxh a3kgdGVzdHMKIFBhdGNoOiAgICAgICAgICBEamFuZ28tc2tpcC1mbGFreS10ZXN0cy5kaWZmCiAK CmRpZmYgLS1naXQgYS9zZXJpZXMgYi9zZXJpZXMKaW5kZXggMmZlMzRjOC4uOTAzZDMzYyAxMDA2 NDQKLS0tIGEvc2VyaWVzCisrKyBiL3NlcmllcwpAQCAtMSw0ICsxLDYgQEAKIGRqYW5nby00LjIu MjItcmV2ZXJ0LXNldHVwdG9vbHMtYnVtcC5kaWZmCiBkamFuZ28tNC4yLjIyLXJldmVydC1weXBy b2plY3QtY29udmVyc2lvbi5kaWZmCiBiYWNrcG9ydC0zNDI2YTVjMzNjMzYyNjZhZjQyMTI4ZWU5 ZWNhNDkyMWU2OGVhODc2LnBhdGNoCitiYWNrcG9ydC1DVkUtMjAyNi0zNTE5Mi5kaWZmCiBEamFu Z28tc2tpcC1mbGFreS11bmljb2RlLXRlc3RzLmRpZmYKKwo=