← Back to branch summary

~ubuntu-branches/ubuntu/precise/python-django/precise-security

« back to all changes in this revision

Viewing changes to debian/changelog

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2014-04-19 09:27:04 UTC
  • Revision ID: package-import@ubuntu.com-20140419092704-idk5scwcmgbm1f9r
Tags: 1.3.1-4ubuntu1.9
https://launchpad.net/bugs/1309779
https://launchpad.net/bugs/1309782
https://launchpad.net/bugs/1309784
* SECURITY UPDATE: unexpected code execution using reverse()
  (LP: #1309779)
  - debian/patches/CVE-2014-0472.patch: added filtering to
    django/core/urlresolvers.py, added tests to
    tests/regressiontests/urlpatterns_reverse/nonimported_module.py,
    tests/regressiontests/urlpatterns_reverse/tests.py,
    tests/regressiontests/urlpatterns_reverse/urls.py,
    tests/regressiontests/urlpatterns_reverse/views.py.
  - CVE-2014-0472
* SECURITY UPDATE: caching of anonymous pages could reveal CSRF token
  (LP: #1309782)
  - debian/patches/CVE-2014-0473.patch: don't cache responses with a
    cookie in django/middleware/cache.py.
  - CVE-2014-0473
* SECURITY UPDATE: MySQL typecasting issue (LP: #1309784)
  - debian/patches/CVE-2014-0474.patch: convert arguments to correct
    type in django/db/models/fields/__init__.py, updated docs in
    docs/howto/custom-model-fields.txt, docs/ref/databases.txt,
    docs/ref/models/querysets.txt, docs/topics/db/sql.txt, added tests to
    tests/regressiontests/model_fields/tests.py.
  - CVE-2014-0474

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/changelog
 
1
python-django (1.3.1-4ubuntu1.9) precise-security; urgency=medium
 
2
 
 
3
  * SECURITY UPDATE: unexpected code execution using reverse()
 
4
    (LP: #1309779)
 
5
    - debian/patches/CVE-2014-0472.patch: added filtering to
 
6
      django/core/urlresolvers.py, added tests to
 
7
      tests/regressiontests/urlpatterns_reverse/nonimported_module.py,
 
8
      tests/regressiontests/urlpatterns_reverse/tests.py,
 
9
      tests/regressiontests/urlpatterns_reverse/urls.py,
 
10
      tests/regressiontests/urlpatterns_reverse/views.py.
 
11
    - CVE-2014-0472
 
12
  * SECURITY UPDATE: caching of anonymous pages could reveal CSRF token
 
13
    (LP: #1309782)
 
14
    - debian/patches/CVE-2014-0473.patch: don't cache responses with a
 
15
      cookie in django/middleware/cache.py.
 
16
    - CVE-2014-0473
 
17
  * SECURITY UPDATE: MySQL typecasting issue (LP: #1309784)
 
18
    - debian/patches/CVE-2014-0474.patch: convert arguments to correct
 
19
      type in django/db/models/fields/__init__.py, updated docs in
 
20
      docs/howto/custom-model-fields.txt, docs/ref/databases.txt,
 
21
      docs/ref/models/querysets.txt, docs/topics/db/sql.txt, added tests to
 
22
      tests/regressiontests/model_fields/tests.py.
 
23
    - CVE-2014-0474
 
24
 
 
25
 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 19 Apr 2014 09:27:04 -0400
 
26
 
1
27
python-django (1.3.1-4ubuntu1.8) precise-security; urgency=low
2
28
 
3
29
  * SECURITY UPDATE: denial of service via long passwords (LP: #1225784)