Package "python-django-doc"

  python-django (1.6.11-0ubuntu1.3) trusty-security; urgency=medium

  * SECURITY UPDATE: content spoofing in the default 404 page
    - debian/patches/CVE-2019-3498.patch: properly quote string in
      django/views/defaults.py.
    - CVE-2019-3498

 -- Marc Deslauriers <email address hidden> Tue, 08 Jan 2019 14:00:29 -0500

  python-django (1.6.11-0ubuntu1.2) trusty-security; urgency=medium

  * SECURITY UPDATE: DoS in urlize and urlizetrunc template filters
    - debian/patches/CVE-2018-7536.patch: fix backtracking in
      django/utils/html.py, add test to tests/utils_tests/test_html.py.
    - CVE-2018-7536
  * SECURITY UPDATE: DoS in truncatechars_html and truncatewords_html
    template filters
    - debian/patches/CVE-2018-7537.patch: fix backtracking in
      django/utils/text.py, add test to tests/utils_tests/test_text.py.
    - CVE-2018-7537

 -- Marc Deslauriers <email address hidden> Mon, 05 Mar 2018 15:52:37 +0100

  python-django (1.6.11-0ubuntu1.1) trusty-security; urgency=medium

  * SECURITY UPDATE: Open redirect and possible XSS attack via
    user-supplied numeric redirect URLs
    - debian/patches/CVE-2017-7233.patch: fix is_safe_url() with numeric
      URLs in django/utils/http.py, added tests to
      tests/utils_tests/test_http.py.
    - CVE-2017-7233
  * SECURITY UPDATE: Open redirect vulnerability in
    django.views.static.serve()
    - debian/patches/CVE-2017-7234.patch: remove redirect from
      django/views/static.py.
    - CVE-2017-7234

 -- Marc Deslauriers <email address hidden> Wed, 29 Mar 2017 07:38:12 -0400

  python-django (1.6.1-2ubuntu0.16) trusty-security; urgency=medium

  * SECURITY UPDATE: user with hardcoded password created when running
    tests on Oracle
    - debian/patches/CVE-2016-9013.patch: remove hardcoded password in
      django/db/backends/oracle/creation.py, added note to
      docs/ref/settings.txt.
    - CVE-2016-9013
  * SECURITY UPDATE: DNS rebinding vulnerability when DEBUG=True
    - debian/patches/CVE-2016-9014.patch: properly check ALLOWED_HOSTS in
      django/http/request.py, updated docs/ref/settings.txt, added test to
      tests/requests/tests.py.
    - CVE-2016-9014

 -- Marc Deslauriers <email address hidden> Mon, 31 Oct 2016 10:14:20 -0400

  python-django (1.6.1-2ubuntu0.15) trusty-security; urgency=medium

  * SECURITY UPDATE: CSRF protection bypass on a site with Google Analytics
    - debian/patches/CVE-2016-7401.patch: simplify cookie parsing in
      django/http/cookie.py, add tests to tests/httpwrappers/tests.py,
      tests/requests/tests.py.
    - CVE-2016-7401

 -- Marc Deslauriers <email address hidden> Mon, 26 Sep 2016 07:36:53 -0400