new file mode 100644
@@ -0,0 +1,83 @@
+From 5826d1b59363e0208ebbd4a59d3b3ef39cfe14d5 Mon Sep 17 00:00:00 2001
+From: Jake Howard <git@theorangeone.net>
+Date: Wed, 13 Aug 2025 14:13:42 +0200
+Subject: [PATCH] [4.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation
+ against SQL injection in column aliases.
+
+Thanks Eyal Gabay (EyalSec) for the report.
+
+Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.
+CVE: CVE-2025-57833
+Upstream-Status: Backport [https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92]
+(cherry picked from commit 31334e6965ad136a5e369993b01721499c5d1a92)
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ django/db/models/sql/query.py | 1 +
+ tests/annotations/tests.py | 24 ++++++++++++++++++++++++
+ 2 files changed, 25 insertions(+)
+
+diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py
+index e68fd9efb7..5a1b68507b 100644
+--- a/django/db/models/sql/query.py
++++ b/django/db/models/sql/query.py
+@@ -1620,6 +1620,7 @@ class Query(BaseExpression):
+ return target_clause
+
+ def add_filtered_relation(self, filtered_relation, alias):
++ self.check_alias(alias)
+ filtered_relation.alias = alias
+ lookups = dict(get_children_from_q(filtered_relation.condition))
+ relation_lookup_parts, relation_field_parts, _ = self.solve_lookup_type(
+diff --git a/tests/annotations/tests.py b/tests/annotations/tests.py
+index e0cdbf1e0b..a8474abc77 100644
+--- a/tests/annotations/tests.py
++++ b/tests/annotations/tests.py
+@@ -12,6 +12,7 @@ from django.db.models import (
+ Exists,
+ ExpressionWrapper,
+ F,
++ FilteredRelation,
+ FloatField,
+ Func,
+ IntegerField,
+@@ -1121,6 +1122,15 @@ class NonAggregateAnnotationTestCase(TestCase):
+ with self.assertRaisesMessage(ValueError, msg):
+ Book.objects.annotate(**{crafted_alias: Value(1)})
+
++ def test_alias_filtered_relation_sql_injection(self):
++ crafted_alias = """injected_name" from "annotations_book"; --"""
++ msg = (
++ "Column aliases cannot contain whitespace characters, quotation marks, "
++ "semicolons, or SQL comments."
++ )
++ with self.assertRaisesMessage(ValueError, msg):
++ Book.objects.annotate(**{crafted_alias: FilteredRelation("author")})
++
+ def test_alias_forbidden_chars(self):
+ tests = [
+ 'al"ias',
+@@ -1146,6 +1156,11 @@ class NonAggregateAnnotationTestCase(TestCase):
+ with self.assertRaisesMessage(ValueError, msg):
+ Book.objects.annotate(**{crafted_alias: Value(1)})
+
++ with self.assertRaisesMessage(ValueError, msg):
++ Book.objects.annotate(
++ **{crafted_alias: FilteredRelation("authors")}
++ )
++
+
+ class AliasTests(TestCase):
+ @classmethod
+@@ -1418,3 +1433,12 @@ class AliasTests(TestCase):
+ )
+ with self.assertRaisesMessage(ValueError, msg):
+ Book.objects.alias(**{crafted_alias: Value(1)})
++
++ def test_alias_filtered_relation_sql_injection(self):
++ crafted_alias = """injected_name" from "annotations_book"; --"""
++ msg = (
++ "Column aliases cannot contain whitespace characters, quotation marks, "
++ "semicolons, or SQL comments."
++ )
++ with self.assertRaisesMessage(ValueError, msg):
++ Book.objects.alias(**{crafted_alias: FilteredRelation("authors")})
@@ -10,6 +10,7 @@ SRC_URI += " \
file://CVE-2025-48432-4.patch \
file://CVE-2025-48432-5.patch \
file://CVE-2025-48432-6.patch \
+ file://CVE-2025-57833.patch \
"
SRC_URI[sha256sum] = "92bac5b4432a64532abb73b2ac27203f485e40225d2640a7fbef2b62b876e789"
Details https://nvd.nist.gov/vuln/detail/CVE-2025-57833 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> --- .../CVE-2025-57833.patch | 83 +++++++++++++++++++ .../python/python3-django_4.2.20.bb | 1 + 2 files changed, 84 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-django-4.2.20/CVE-2025-57833.patch