* [Buildroot] [PATCH] python-django: security bump to version 1.10.7
@ 2017-04-27 7:37 Peter Korsgaard
2017-04-27 19:27 ` Peter Korsgaard
2017-04-28 12:53 ` Peter Korsgaard
0 siblings, 2 replies; 3+ messages in thread
From: Peter Korsgaard @ 2017-04-27 7:37 UTC (permalink / raw)
To: buildroot
Fixes the following security issues:
Since 1.10.3:
CVE-2016-9013 - User with hardcoded password created when running tests on
Oracle
Marti Raudsepp reported that a user with a hardcoded password is created
when running tests with an Oracle database.
CVE-2016-9014 - DNS rebinding vulnerability when DEBUG=True
Aymeric Augustin discovered that Django does not properly validate the Host
header against settings.ALLOWED_HOSTS when the debug setting is enabled. A
remote attacker can take advantage of this flaw to perform DNS rebinding
attacks.
Since 1.10.7:
CVE-2017-7233 - Open redirect and possible XSS attack via user-supplied
numeric redirect URLs
It was discovered that is_safe_url() does not properly handle certain
numeric URLs as safe. A remote attacker can take advantage of this flaw to
perform XSS attacks or to use a Django server as an open redirect.
CVE-2017-7234 - Open redirect vulnerability in django.views.static.serve()
Phithon from Chaitin Tech discovered an open redirect vulnerability in the
django.views.static.serve() view. Note that this view is not intended for
production use.
Cc: Oli Vogt <oli.vogt.pub01@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
package/python-django/python-django.hash | 4 ++--
package/python-django/python-django.mk | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/package/python-django/python-django.hash b/package/python-django/python-django.hash
index 38b303bbf..09be18440 100644
--- a/package/python-django/python-django.hash
+++ b/package/python-django/python-django.hash
@@ -1,3 +1,3 @@
# md5 from https://pypi.python.org/pypi/django/json, sha256 locally computed
-md5 5342e77374b2acd2eafa86d2bb68f8c9 Django-1.10.2.tar.gz
-sha256 e127f12a0bfb34843b6e8c82f91e26fff6445a7ca91d222c0794174cf97cbce1 Django-1.10.2.tar.gz
+md5 693dfeabad62c561cb205900d32c2a98 Django-1.10.7.tar.gz
+sha256 593d779dbc2350a245c4f76d26bdcad58a39895e87304fe6d725bbdf84b5b0b8 Django-1.10.7.tar.gz
diff --git a/package/python-django/python-django.mk b/package/python-django/python-django.mk
index 9065a687e..9056f00cf 100644
--- a/package/python-django/python-django.mk
+++ b/package/python-django/python-django.mk
@@ -4,10 +4,10 @@
#
################################################################################
-PYTHON_DJANGO_VERSION = 1.10.2
+PYTHON_DJANGO_VERSION = 1.10.7
PYTHON_DJANGO_SOURCE = Django-$(PYTHON_DJANGO_VERSION).tar.gz
# The official Django site has an unpractical URL
-PYTHON_DJANGO_SITE = https://pypi.python.org/packages/57/9e/59444485f092b6ed4f1931e7d2e13b67fdab967c041d02f58a0d1dab8c23
+PYTHON_DJANGO_SITE = https://pypi.python.org/packages/15/b4/d4bb7313e02386bd23a60e1eb5670321313fb67289c6f36ec43bce747aff
PYTHON_DJANGO_LICENSE = BSD-3-Clause
PYTHON_DJANGO_LICENSE_FILES = LICENSE
PYTHON_DJANGO_SETUP_TYPE = setuptools
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH] python-django: security bump to version 1.10.7
2017-04-27 7:37 [Buildroot] [PATCH] python-django: security bump to version 1.10.7 Peter Korsgaard
@ 2017-04-27 19:27 ` Peter Korsgaard
2017-04-28 12:53 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2017-04-27 19:27 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> Fixes the following security issues:
> Since 1.10.3:
> CVE-2016-9013 - User with hardcoded password created when running tests on
> Oracle
> Marti Raudsepp reported that a user with a hardcoded password is created
> when running tests with an Oracle database.
> CVE-2016-9014 - DNS rebinding vulnerability when DEBUG=True
> Aymeric Augustin discovered that Django does not properly validate the Host
> header against settings.ALLOWED_HOSTS when the debug setting is enabled. A
> remote attacker can take advantage of this flaw to perform DNS rebinding
> attacks.
> Since 1.10.7:
> CVE-2017-7233 - Open redirect and possible XSS attack via user-supplied
> numeric redirect URLs
> It was discovered that is_safe_url() does not properly handle certain
> numeric URLs as safe. A remote attacker can take advantage of this flaw to
> perform XSS attacks or to use a Django server as an open redirect.
> CVE-2017-7234 - Open redirect vulnerability in django.views.static.serve()
> Phithon from Chaitin Tech discovered an open redirect vulnerability in the
> django.views.static.serve() view. Note that this view is not intended for
> production use.
> Cc: Oli Vogt <oli.vogt.pub01@gmail.com>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH] python-django: security bump to version 1.10.7
2017-04-27 7:37 [Buildroot] [PATCH] python-django: security bump to version 1.10.7 Peter Korsgaard
2017-04-27 19:27 ` Peter Korsgaard
@ 2017-04-28 12:53 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2017-04-28 12:53 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> Fixes the following security issues:
> Since 1.10.3:
> CVE-2016-9013 - User with hardcoded password created when running tests on
> Oracle
> Marti Raudsepp reported that a user with a hardcoded password is created
> when running tests with an Oracle database.
> CVE-2016-9014 - DNS rebinding vulnerability when DEBUG=True
> Aymeric Augustin discovered that Django does not properly validate the Host
> header against settings.ALLOWED_HOSTS when the debug setting is enabled. A
> remote attacker can take advantage of this flaw to perform DNS rebinding
> attacks.
> Since 1.10.7:
> CVE-2017-7233 - Open redirect and possible XSS attack via user-supplied
> numeric redirect URLs
> It was discovered that is_safe_url() does not properly handle certain
> numeric URLs as safe. A remote attacker can take advantage of this flaw to
> perform XSS attacks or to use a Django server as an open redirect.
> CVE-2017-7234 - Open redirect vulnerability in django.views.static.serve()
> Phithon from Chaitin Tech discovered an open redirect vulnerability in the
> django.views.static.serve() view. Note that this view is not intended for
> production use.
> Cc: Oli Vogt <oli.vogt.pub01@gmail.com>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed to 2017.02.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-04-28 12:53 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-04-27 7:37 [Buildroot] [PATCH] python-django: security bump to version 1.10.7 Peter Korsgaard
2017-04-27 19:27 ` Peter Korsgaard
2017-04-28 12:53 ` Peter Korsgaard
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.