UbuntuUpdates.org

Package "python-django-doc"

Name: python-django-doc

Description:

High-level Python web development framework (documentation)
Latest version: 1.6.11-0ubuntu1.3
Release: trusty (14.04)
Level: updates
Repository: main
Head package: python-django
Homepage: http://www.djangoproject.com/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python-django-doc"

All arch deb package
APT INSTALL

Other versions of "python-django-doc" in Trusty

Repository Area Version
base main 1.6.1-2
security main 1.6.11-0ubuntu1.3

Changelog

Version: 1.6.11-0ubuntu1.3 2019-01-09 21:06:44 UTC

  python-django (1.6.11-0ubuntu1.3) trusty-security; urgency=medium

  * SECURITY UPDATE: content spoofing in the default 404 page
    - debian/patches/CVE-2019-3498.patch: properly quote string in
      django/views/defaults.py.
    - CVE-2019-3498

 -- Marc Deslauriers <email address hidden> Tue, 08 Jan 2019 14:00:29 -0500
Source diff to previous version
CVE-2019-3498 Content spoofing possibility in the default 404 page

Version: 1.6.11-0ubuntu1.2 2018-03-06 17:07:22 UTC

  python-django (1.6.11-0ubuntu1.2) trusty-security; urgency=medium

  * SECURITY UPDATE: DoS in urlize and urlizetrunc template filters
    - debian/patches/CVE-2018-7536.patch: fix backtracking in
      django/utils/html.py, add test to tests/utils_tests/test_html.py.
    - CVE-2018-7536
  * SECURITY UPDATE: DoS in truncatechars_html and truncatewords_html
    template filters
    - debian/patches/CVE-2018-7537.patch: fix backtracking in
      django/utils/text.py, add test to tests/utils_tests/test_text.py.
    - CVE-2018-7537

 -- Marc Deslauriers <email address hidden> Mon, 05 Mar 2018 15:52:37 +0100
Source diff to previous version
CVE-2018-7536 Denial-of-service possibility in urlize and urlizetrunc template filters
CVE-2018-7537 Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

Version: 1.6.11-0ubuntu1.1 2017-04-04 20:06:27 UTC

  python-django (1.6.11-0ubuntu1.1) trusty-security; urgency=medium

  * SECURITY UPDATE: Open redirect and possible XSS attack via
    user-supplied numeric redirect URLs
    - debian/patches/CVE-2017-7233.patch: fix is_safe_url() with numeric
      URLs in django/utils/http.py, added tests to
      tests/utils_tests/test_http.py.
    - CVE-2017-7233
  * SECURITY UPDATE: Open redirect vulnerability in
    django.views.static.serve()
    - debian/patches/CVE-2017-7234.patch: remove redirect from
      django/views/static.py.
    - CVE-2017-7234

 -- Marc Deslauriers <email address hidden> Wed, 29 Mar 2017 07:38:12 -0400
Source diff to previous version
CVE-2017-7233 Open redirect and possible XSS attack via user-supplied numeric redirect URLs
CVE-2017-7234 Open redirect vulnerability in django.views.static.serve()

Version: 1.6.11-0ubuntu1 2016-12-07 14:07:04 UTC

  python-django (1.6.11-0ubuntu1) trusty; urgency=medium

  * Update to final upstream 1.6 microrelease (LP: #1644346)
  * Drop patches included upstream:
    - debian/patches/07_translation_encoding_fix.diff, ticket21869.diff,
      CVE-2014-0472.patch, CVE-2014-0473.patch, CVE-2014-0474.patch,
      CVE-2014-0472-regression.patch, drop_fix_ie_for_vary_1_6.diff,
      is_safe_url_1_6.diff, CVE-2014-0480.patch, CVE-2014-0481.patch,
      CVE-2014-0482.patch, CVE-2014-0483.patch, CVE-2014-0483-bug23329.patch,
      CVE-2014-0483-bug23431.patch, CVE-2015-0219.patch, CVE-2015-0220.patch,
      CVE-2015-0221.patch, CVE-2015-0222.patch, CVE-2015-2316.patch, and
      CVE-2015-2317.patch

 -- Scott Kitterman <email address hidden> Wed, 23 Nov 2016 14:41:31 -0500
Source diff to previous version
1644346 SRU update Trusty to Python Django 1.6.11
CVE-2014-0472 Unexpected code execution using ``reverse()``
CVE-2014-0473 Caching of anonymous pages could reveal CSRF token
CVE-2014-0474 MySQL typecasting could result in unexpected matches
CVE-2014-0480 The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x ...
CVE-2014-0481 The default configuration for the file upload handling system in ...
CVE-2014-0482 The contrib.auth.middleware.RemoteUserMiddleware middleware in Django ...
CVE-2014-0483 The administrative interface (contrib.admin) in Django before 1.4.14, ...
CVE-2015-0219 RESERVED
CVE-2015-0220 RESERVED
CVE-2015-0221 RESERVED
CVE-2015-0222 RESERVED
CVE-2015-2316 Denial-of-service possibility with strip_tags()
CVE-2015-2317 Mitigated possible XSS attack via user-supplied redirect URLs

Version: 1.6.1-2ubuntu0.16 2016-11-01 20:06:57 UTC

  python-django (1.6.1-2ubuntu0.16) trusty-security; urgency=medium

  * SECURITY UPDATE: user with hardcoded password created when running
    tests on Oracle
    - debian/patches/CVE-2016-9013.patch: remove hardcoded password in
      django/db/backends/oracle/creation.py, added note to
      docs/ref/settings.txt.
    - CVE-2016-9013
  * SECURITY UPDATE: DNS rebinding vulnerability when DEBUG=True
    - debian/patches/CVE-2016-9014.patch: properly check ALLOWED_HOSTS in
      django/http/request.py, updated docs/ref/settings.txt, added test to
      tests/requests/tests.py.
    - CVE-2016-9014

 -- Marc Deslauriers <email address hidden> Mon, 31 Oct 2016 10:14:20 -0400
CVE-2016-9013 User with hardcoded password created when running tests on Oracle
CVE-2016-9014 DNS rebinding vulnerability when DEBUG=True


About   -   Send Feedback to @ubuntu_updates