SB20260509153 - openEuler 20.03 LTS SP4 update for python-django

Description

This security bulletin contains information about 4 vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-25674)

The vulnerability allows a local user to alter application behavior. 

The vulnerability exists due to incorrect permissions set for newly created directories. A local user can potentially write files into the directory before proper permissions are applied. 

2) Resource exhaustion (CVE-ID: CVE-2026-33033)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in django.http.multipartparser.MultiPartParser when processing multipart uploads with base64-encoded files containing excessive whitespace. A remote attacker can send a specially crafted multipart upload to cause a denial of service.

The issue may trigger repeated memory copying and degrade performance.

3) Improper access control (CVE-ID: CVE-2026-4277)

The vulnerability allows a remote user to create inline model instances without proper add permissions.

The vulnerability exists due to improper access control in GenericInlineModelAdmin when processing forged POST data. A remote user can submit forged POST data to create inline model instances without proper add permissions.

4) Improper access control (CVE-ID: CVE-2026-4292)

The vulnerability allows a remote user to create new instances through admin changelist forms.

The vulnerability exists due to improper access control in ModelAdmin.list_editable when processing forged POST data. A remote user can submit forged POST data to create new instances through admin changelist forms.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2216