Package "python-django"

  python-django (2:2.2.12-1ubuntu0.5) focal-security; urgency=medium

  * SECURITY UPDATE: Potential directory-traversal via uploaded files
    - debian/patches/CVE-2021-28658.patch: properly sanitize filenames in
      django/http/multipartparser.py, tests/file_uploads/tests.py,
      tests/file_uploads/uploadhandler.py, tests/file_uploads/urls.py,
      tests/file_uploads/views.py.
    - CVE-2021-28658

 -- Marc Deslauriers <email address hidden> Tue, 30 Mar 2021 14:53:19 -0400

  python-django (2:2.2.12-1ubuntu0.4) focal-security; urgency=medium

  * SECURITY UPDATE: Web cache poisoning via limited_parse_qsl()
    - debian/patches/CVE-2021-23336.patch: no longer allow ; in parse_qsl()
      in django/utils/http.py, tests/handlers/test_exception.py,
      tests/requests/test_data_upload_settings.py,
      tests/utils_tests/test_http.py.
    - CVE-2021-23336

 -- Marc Deslauriers <email address hidden> Thu, 18 Feb 2021 10:40:54 -0500

  python-django (2:2.2.12-1ubuntu0.3) focal-security; urgency=medium

  * SECURITY UPDATE: Potential directory-traversal via archive.extract()
    - debian/patches/CVE-2021-3281.patch: check for invalid paths in
      django/utils/archive.py.
    - CVE-2021-3281

 -- Marc Deslauriers <email address hidden> Mon, 25 Jan 2021 07:31:24 -0500

  python-django (2:2.2.12-1ubuntu0.2) focal-security; urgency=medium

  * SECURITY UPDATE: Incorrect permissions on intermediate-level
    directories on Python 3.7+
    - debian/patches/CVE-2020-24583.patch: set umask in
      django/core/files/storage.py, added test and test files to tests/*.
    - CVE-2020-24583
  * SECURITY UPDATE: Permission escalation in intermediate-level
    directories of the file system cache on Python 3.7+
    - debian/patches/CVE-2020-24584.patch: set umask in
      django/core/cache/backends/filebased.py, added test to
      tests/cache/tests.py.
    - CVE-2020-24584

 -- Marc Deslauriers <email address hidden> Tue, 25 Aug 2020 09:58:36 -0400

  python-django (2:2.2.12-1ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: Potential data leakage via malformed memcached keys
    - debian/patches/CVE-2020-13254.patch: enforced cache key validation in
      memcached backends in django/core/cache/__init__.py,
      django/core/cache/backends/base.py,
      django/core/cache/backends/memcached.py, tests/cache/tests.py.
    - CVE-2020-13254
  * SECURITY UPDATE: Possible XSS via admin ForeignKeyRawIdWidget
    - debian/patches/CVE-2020-13596.patch: fixed potential XSS in admin
      ForeignKeyRawIdWidget in django/contrib/admin/widgets.py,
      tests/admin_widgets/models.py, tests/admin_widgets/tests.py.
    - CVE-2020-13596

 -- Marc Deslauriers <email address hidden> Thu, 28 May 2020 10:10:05 -0400