← Back to branch summary

~ubuntu-branches/ubuntu/lucid/python-django/lucid-security

« back to all changes in this revision

Viewing changes to debian/changelog

  • Committer: Bazaar Package Importer
  • Author(s): Jamie Strandboge
  • Date: 2011-02-15 17:11:08 UTC
  • Revision ID: james.westby@ubuntu.com-20110215171108-jeg1jydwjjy5trgu
Tags: 1.1.1-2ubuntu1.3
https://launchpad.net/bugs/719031
* SECURITY UPDATE: flaw in CSRF handling (LP: #719031)
  - debian/patches/10_CVE-2011-0696.diff: apply full CSRF validation to all
    requests, regardless of apparent AJAX origin. This is technically
    backwards-incompatible, but the security risks have been judged to
    outweigh the compatibility concerns in this case. See the Django project
    notes for more information:
    http://www.djangoproject.com/weblog/2011/feb/08/security/
  - CVE-2011-0696
* SECURITY UPDATE: potential XSS in file field rendering
  - debian/patches/11_CVE-2011-0697.diff: properly escape URL in
    django/contrib/admin/widgets.py
  - CVE-2011-0697

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/changelog
 
1
python-django (1.1.1-2ubuntu1.3) lucid-security; urgency=low
 
2
 
 
3
  * SECURITY UPDATE: flaw in CSRF handling (LP: #719031)
 
4
    - debian/patches/10_CVE-2011-0696.diff: apply full CSRF validation to all
 
5
      requests, regardless of apparent AJAX origin. This is technically
 
6
      backwards-incompatible, but the security risks have been judged to
 
7
      outweigh the compatibility concerns in this case. See the Django project
 
8
      notes for more information:
 
9
      http://www.djangoproject.com/weblog/2011/feb/08/security/
 
10
    - CVE-2011-0696
 
11
  * SECURITY UPDATE: potential XSS in file field rendering
 
12
    - debian/patches/11_CVE-2011-0697.diff: properly escape URL in
 
13
      django/contrib/admin/widgets.py
 
14
    - CVE-2011-0697
 
15
 
 
16
 -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 15 Feb 2011 17:11:08 -0600
 
17
 
1
18
python-django (1.1.1-2ubuntu1.2) lucid-security; urgency=low
2
19
 
3
20
  * SECURITY UPDATE: information leak in admin interface