Package "python-django"

  python-django (1:1.11.11-1ubuntu1.13) bionic-security; urgency=medium

  * SECURITY UPDATE: Potential directory-traversal via uploaded files
    - debian/patches/CVE-2021-31542.patch: tighten path & file name
      sanitation in file uploads in django/core/files/storage.py,
      django/core/files/uploadedfile.py, django/core/files/utils.py,
      django/db/models/fields/files.py, django/http/multipartparser.py,
      django/utils/text.py, tests/file_storage/test_generate_filename.py,
      tests/file_uploads/tests.py, tests/utils_tests/test_text.py,
      tests/forms_tests/field_tests/test_filefield.py.
    - CVE-2021-31542

 -- Marc Deslauriers <email address hidden> Wed, 28 Apr 2021 06:44:31 -0400

  python-django (1:1.11.11-1ubuntu1.12) bionic-security; urgency=medium

  * SECURITY UPDATE: Potential directory-traversal via uploaded files
    - debian/patches/CVE-2021-28658.patch: properly sanitize filenames in
      django/http/multipartparser.py, tests/file_uploads/tests.py,
      tests/file_uploads/uploadhandler.py, tests/file_uploads/urls.py,
      tests/file_uploads/views.py.
    - CVE-2021-28658

 -- Marc Deslauriers <email address hidden> Tue, 30 Mar 2021 14:55:49 -0400

  python-django (1:1.11.11-1ubuntu1.11) bionic-security; urgency=medium

  * SECURITY UPDATE: Web cache poisoning via limited_parse_qsl()
    - debian/patches/CVE-2021-23336.patch: no longer allow ; in parse_qsl()
      in django/utils/http.py, tests/handlers/test_exception.py,
      tests/requests/test_data_upload_settings.py,
      tests/utils_tests/test_http.py.
    - CVE-2021-23336

 -- Marc Deslauriers <email address hidden> Thu, 18 Feb 2021 10:44:15 -0500

  python-django (1:1.11.11-1ubuntu1.10) bionic-security; urgency=medium

  * SECURITY UPDATE: Potential directory-traversal via archive.extract()
    - debian/patches/CVE-2021-3281.patch: check for invalid paths in
      django/utils/archive.py.
    - CVE-2021-3281

 -- Marc Deslauriers <email address hidden> Mon, 25 Jan 2021 07:34:39 -0500

  python-django (1:1.11.11-1ubuntu1.9) bionic-security; urgency=medium

  * SECURITY UPDATE: Potential data leakage via malformed memcached keys
    - debian/patches/CVE-2020-13254.patch: enforced cache key validation in
      memcached backends in django/core/cache/__init__.py,
      django/core/cache/backends/base.py,
      django/core/cache/backends/memcached.py, tests/cache/tests.py.
    - CVE-2020-13254
  * SECURITY UPDATE: Possible XSS via admin ForeignKeyRawIdWidget
    - debian/patches/CVE-2020-13596.patch: fixed potential XSS in admin
      ForeignKeyRawIdWidget in django/contrib/admin/widgets.py,
      tests/admin_widgets/models.py, tests/admin_widgets/tests.py.
    - CVE-2020-13596

 -- Marc Deslauriers <email address hidden> Thu, 28 May 2020 10:30:39 -0400