UbuntuUpdates.org

Package "python-django"

Name: python-django

Description:

High-level Python web development framework (Python 2 version)

Latest version: 1.8.7-1ubuntu5.8
Release: xenial (16.04)
Level: security
Repository: main
Homepage: http://www.djangoproject.com/

Links

Save this URL for the latest version of "python-django": https://www.ubuntuupdates.org/python-django


Download "python-django"


Other versions of "python-django" in Xenial

Repository Area Version
base main 1.8.7-1ubuntu5
updates main 1.8.7-1ubuntu5.8

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.8.7-1ubuntu5.8 2019-02-13 15:07:02 UTC

  python-django (1.8.7-1ubuntu5.8) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS via memory exhaustion
    - debian/patches/CVE-2019-6975.patch: limit digits in
      django/utils/numberformat.py, added tests to
      tests/utils_tests/test_numberformat.py.
    - CVE-2019-6975

 -- Marc Deslauriers <email address hidden> Tue, 12 Feb 2019 08:55:08 -0500

Source diff to previous version
CVE-2019-6975 Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied va

Version: 1.8.7-1ubuntu5.7 2019-01-09 19:07:05 UTC

  python-django (1.8.7-1ubuntu5.7) xenial-security; urgency=medium

  * SECURITY UPDATE: content spoofing in the default 404 page
    - debian/patches/CVE-2019-3498.patch: properly quote string in
      django/views/defaults.py, add test to tests/handlers/tests.py.
    - CVE-2019-3498

 -- Marc Deslauriers <email address hidden> Tue, 08 Jan 2019 13:45:35 -0500

Source diff to previous version
CVE-2019-3498 Content spoofing possibility in the default 404 page

Version: 1.8.7-1ubuntu5.6 2018-03-08 14:06:27 UTC

  python-django (1.8.7-1ubuntu5.6) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS in urlize and urlizetrunc template filters
    - debian/patches/CVE-2018-7536.patch: fix backtracking in
      django/utils/html.py, add test to tests/utils_tests/test_html.py.
    - CVE-2018-7536
  * SECURITY UPDATE: DoS in truncatechars_html and truncatewords_html
    template filters
    - debian/patches/CVE-2018-7537.patch: fix backtracking in
      django/utils/text.py, add test to tests/utils_tests/test_text.py.
    - CVE-2018-7537

 -- Marc Deslauriers <email address hidden> Mon, 05 Mar 2018 15:32:46 +0100

Source diff to previous version
CVE-2018-7536 Denial-of-service possibility in urlize and urlizetrunc template filters
CVE-2018-7537 Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

Version: 1.8.7-1ubuntu5.5 2017-04-04 18:07:00 UTC

  python-django (1.8.7-1ubuntu5.5) xenial-security; urgency=medium

  * SECURITY UPDATE: Open redirect and possible XSS attack via
    user-supplied numeric redirect URLs
    - debian/patches/CVE-2017-7233.patch: fix is_safe_url() with numeric
      URLs in django/utils/http.py, added tests to
      tests/utils_tests/test_http.py.
    - CVE-2017-7233
  * SECURITY UPDATE: Open redirect vulnerability in
    django.views.static.serve()
    - debian/patches/CVE-2017-7234.patch: remove redirect from
      django/views/static.py.
    - CVE-2017-7234

 -- Marc Deslauriers <email address hidden> Wed, 29 Mar 2017 07:34:09 -0400

Source diff to previous version
CVE-2017-7233 Open redirect and possible XSS attack via user-supplied numeric redirect URLs
CVE-2017-7234 Open redirect vulnerability in django.views.static.serve()

Version: 1.8.7-1ubuntu5.4 2016-11-01 18:06:50 UTC

  python-django (1.8.7-1ubuntu5.4) xenial-security; urgency=medium

  * SECURITY UPDATE: user with hardcoded password created when running
    tests on Oracle
    - debian/patches/CVE-2016-9013.patch: remove hardcoded password in
      django/db/backends/oracle/creation.py, added note to
      docs/ref/settings.txt.
    - CVE-2016-9013
  * SECURITY UPDATE: DNS rebinding vulnerability when DEBUG=True
    - debian/patches/CVE-2016-9014.patch: properly check ALLOWED_HOSTS in
      django/http/request.py, updated docs/ref/settings.txt, added test to
      tests/requests/tests.py.
    - CVE-2016-9014
  * This update does _not_ contain the changes from 1.8.7-1ubuntu5.3 in
    xenial-proposed.

 -- Marc Deslauriers <email address hidden> Mon, 31 Oct 2016 09:57:03 -0400

CVE-2016-9013 User with hardcoded password created when running tests on Oracle
CVE-2016-9014 DNS rebinding vulnerability when DEBUG=True



About   -   Send Feedback to @ubuntu_updates