UbuntuUpdates.org

Package "python-django"

Name: python-django

Description:

High-level Python web development framework (Python 2 version)

Latest version: 1:1.11.11-1ubuntu1.12
Release: bionic (18.04)
Level: security
Repository: main
Homepage: http://www.djangoproject.com/

Links


Download "python-django"


Other versions of "python-django" in Bionic

Repository Area Version
base main 1:1.11.11-1ubuntu1
updates main 1:1.11.11-1ubuntu1.12

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1:1.11.11-1ubuntu1.12 2021-04-06 13:07:10 UTC

  python-django (1:1.11.11-1ubuntu1.12) bionic-security; urgency=medium

  * SECURITY UPDATE: Potential directory-traversal via uploaded files
    - debian/patches/CVE-2021-28658.patch: properly sanitize filenames in
      django/http/multipartparser.py, tests/file_uploads/tests.py,
      tests/file_uploads/uploadhandler.py, tests/file_uploads/urls.py,
      tests/file_uploads/views.py.
    - CVE-2021-28658

 -- Marc Deslauriers <email address hidden> Tue, 30 Mar 2021 14:55:49 -0400

Source diff to previous version

Version: 1:1.11.11-1ubuntu1.11 2021-02-22 15:06:19 UTC

  python-django (1:1.11.11-1ubuntu1.11) bionic-security; urgency=medium

  * SECURITY UPDATE: Web cache poisoning via limited_parse_qsl()
    - debian/patches/CVE-2021-23336.patch: no longer allow ; in parse_qsl()
      in django/utils/http.py, tests/handlers/test_exception.py,
      tests/requests/test_data_upload_settings.py,
      tests/utils_tests/test_http.py.
    - CVE-2021-23336

 -- Marc Deslauriers <email address hidden> Thu, 18 Feb 2021 10:44:15 -0500

Source diff to previous version
CVE-2021-23336 The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulne

Version: 1:1.11.11-1ubuntu1.10 2021-02-01 14:07:54 UTC

  python-django (1:1.11.11-1ubuntu1.10) bionic-security; urgency=medium

  * SECURITY UPDATE: Potential directory-traversal via archive.extract()
    - debian/patches/CVE-2021-3281.patch: check for invalid paths in
      django/utils/archive.py.
    - CVE-2021-3281

 -- Marc Deslauriers <email address hidden> Mon, 25 Jan 2021 07:34:39 -0500

Source diff to previous version

Version: 1:1.11.11-1ubuntu1.9 2020-06-03 12:07:14 UTC

  python-django (1:1.11.11-1ubuntu1.9) bionic-security; urgency=medium

  * SECURITY UPDATE: Potential data leakage via malformed memcached keys
    - debian/patches/CVE-2020-13254.patch: enforced cache key validation in
      memcached backends in django/core/cache/__init__.py,
      django/core/cache/backends/base.py,
      django/core/cache/backends/memcached.py, tests/cache/tests.py.
    - CVE-2020-13254
  * SECURITY UPDATE: Possible XSS via admin ForeignKeyRawIdWidget
    - debian/patches/CVE-2020-13596.patch: fixed potential XSS in admin
      ForeignKeyRawIdWidget in django/contrib/admin/widgets.py,
      tests/admin_widgets/models.py, tests/admin_widgets/tests.py.
    - CVE-2020-13596

 -- Marc Deslauriers <email address hidden> Thu, 28 May 2020 10:30:39 -0400

Source diff to previous version
CVE-2020-13254 RESERVED
CVE-2020-13596 RESERVED

Version: 1:1.11.11-1ubuntu1.8 2020-03-04 14:06:28 UTC

  python-django (1:1.11.11-1ubuntu1.8) bionic-security; urgency=medium

  * SECURITY UPDATE: SQL injection in Oracle GIS functions and aggregates
    - debian/patches/CVE-2020-9402.patch: properly escaped tolerance
      parameter in GIS functions and aggregates on Oracle in
      django/contrib/gis/db/models/aggregates.py,
      django/contrib/gis/db/models/functions.py,
      tests/gis_tests/distapp/tests.py, tests/gis_tests/geoapp/tests.py.
    - CVE-2020-9402

 -- Marc Deslauriers <email address hidden> Fri, 28 Feb 2020 13:07:57 -0500




About   -   Send Feedback to @ubuntu_updates