UbuntuUpdates.org

Package "python-django"

Name: python-django

Description:

High-level Python web development framework (Python 2 version)

Latest version: 1.8.7-1ubuntu5.7
Release: xenial (16.04)
Level: updates
Repository: main
Homepage: http://www.djangoproject.com/

Links

Save this URL for the latest version of "python-django": https://www.ubuntuupdates.org/python-django


Download "python-django"


Other versions of "python-django" in Xenial

Repository Area Version
base main 1.8.7-1ubuntu5
security main 1.8.7-1ubuntu5.7

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.8.7-1ubuntu5.7 2019-01-10 13:06:36 UTC

  python-django (1.8.7-1ubuntu5.7) xenial-security; urgency=medium

  * SECURITY UPDATE: content spoofing in the default 404 page
    - debian/patches/CVE-2019-3498.patch: properly quote string in
      django/views/defaults.py, add test to tests/handlers/tests.py.
    - CVE-2019-3498

 -- Marc Deslauriers <email address hidden> Tue, 08 Jan 2019 13:45:35 -0500

Source diff to previous version
CVE-2019-3498 Content spoofing possibility in the default 404 page

Version: 1.8.7-1ubuntu5.6 2018-03-06 19:06:53 UTC

  python-django (1.8.7-1ubuntu5.6) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS in urlize and urlizetrunc template filters
    - debian/patches/CVE-2018-7536.patch: fix backtracking in
      django/utils/html.py, add test to tests/utils_tests/test_html.py.
    - CVE-2018-7536
  * SECURITY UPDATE: DoS in truncatechars_html and truncatewords_html
    template filters
    - debian/patches/CVE-2018-7537.patch: fix backtracking in
      django/utils/text.py, add test to tests/utils_tests/test_text.py.
    - CVE-2018-7537

 -- Marc Deslauriers <email address hidden> Mon, 05 Mar 2018 15:32:46 +0100

Source diff to previous version
CVE-2018-7536 Denial-of-service possibility in urlize and urlizetrunc template filters
CVE-2018-7537 Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

Version: 1.8.7-1ubuntu5.5 2017-04-04 20:06:29 UTC

  python-django (1.8.7-1ubuntu5.5) xenial-security; urgency=medium

  * SECURITY UPDATE: Open redirect and possible XSS attack via
    user-supplied numeric redirect URLs
    - debian/patches/CVE-2017-7233.patch: fix is_safe_url() with numeric
      URLs in django/utils/http.py, added tests to
      tests/utils_tests/test_http.py.
    - CVE-2017-7233
  * SECURITY UPDATE: Open redirect vulnerability in
    django.views.static.serve()
    - debian/patches/CVE-2017-7234.patch: remove redirect from
      django/views/static.py.
    - CVE-2017-7234

 -- Marc Deslauriers <email address hidden> Wed, 29 Mar 2017 07:34:09 -0400

Source diff to previous version
CVE-2017-7233 Open redirect and possible XSS attack via user-supplied numeric redirect URLs
CVE-2017-7234 Open redirect vulnerability in django.views.static.serve()

Version: 1.8.7-1ubuntu5.4 2016-11-01 20:06:59 UTC

  python-django (1.8.7-1ubuntu5.4) xenial-security; urgency=medium

  * SECURITY UPDATE: user with hardcoded password created when running
    tests on Oracle
    - debian/patches/CVE-2016-9013.patch: remove hardcoded password in
      django/db/backends/oracle/creation.py, added note to
      docs/ref/settings.txt.
    - CVE-2016-9013
  * SECURITY UPDATE: DNS rebinding vulnerability when DEBUG=True
    - debian/patches/CVE-2016-9014.patch: properly check ALLOWED_HOSTS in
      django/http/request.py, updated docs/ref/settings.txt, added test to
      tests/requests/tests.py.
    - CVE-2016-9014
  * This update does _not_ contain the changes from 1.8.7-1ubuntu5.3 in
    xenial-proposed.

 -- Marc Deslauriers <email address hidden> Mon, 31 Oct 2016 09:57:03 -0400

Source diff to previous version
CVE-2016-9013 User with hardcoded password created when running tests on Oracle
CVE-2016-9014 DNS rebinding vulnerability when DEBUG=True

Version: 1.8.7-1ubuntu5.2 2016-09-27 16:06:42 UTC

  python-django (1.8.7-1ubuntu5.2) xenial-security; urgency=medium

  * SECURITY UPDATE: CSRF protection bypass on a site with Google Analytics
    - debian/patches/CVE-2016-7401.patch: simplify cookie parsing in
      django/http/cookie.py, add tests to tests/httpwrappers/tests.py,
      tests/requests/tests.py.
    - CVE-2016-7401

 -- Marc Deslauriers <email address hidden> Mon, 26 Sep 2016 07:29:01 -0400




About   -   Send Feedback to @ubuntu_updates