summaryrefslogtreecommitdiff
path: root/django/__init__.py
diff options
context:
space:
mode:
authorNatalia <124304+nessita@users.noreply.github.com>2026-01-21 18:03:20 -0300
committerNatalia <124304+nessita@users.noreply.github.com>2026-03-03 09:17:39 -0300
commitb07ed2a1e445efde54fc64cb8c37e0f4f7fe53e5 (patch)
tree0c9cba1bad625b92217ceac4733793632f4d7f34 /django/__init__.py
parent4d3c184686626d224d9a87451410ecf802b41f7c (diff)
[5.2.x] Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file system object creation.
This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz <zspytz@gmail.com> Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews. Backport of 019e44f67a8dace67b786e2818938c8691132988 from main.
Diffstat (limited to 'django/__init__.py')
0 files changed, 0 insertions, 0 deletions