Univention Bugzilla – Bug 51543
python-django: Multiple issues (4.4)
Last modified: 2020-06-24 12:53:17 CEST
New Debian python-django 1:1.10.7-2+deb9u9 fixes: This update addresses the following issues: * potential data leakage via malformed memcached keys (CVE-2020-13254) * possible XSS via admin ForeignKeyRawIdWidget (CVE-2020-13596)
--- mirror/ftp/4.4/unmaintained/4.4-4/source/python-django_1.10.7-2+deb9u8.dsc +++ apt/ucs_4.4-0-errata4.4-4/source/python-django_1.10.7-2+deb9u9.dsc @@ -1,3 +1,18 @@ +1:1.10.7-2+deb9u9 [Sat, 13 Jun 2020 15:47:14 +0100] Chris Lamb <lamby@debian.org>: + + * CVE-2020-13254: Potential a data leakage via malformed memcached keys. + + In cases where a memcached backend does not perform key validation, passing + malformed cache keys could result in a key collision, and potential data + leakage. In order to avoid this vulnerability, key validation is added to + the memcached cache backends. + + * CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget. + + Query parameters to the admin ForeignKeyRawIdWidget were not properly URL + encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures + query parameters are correctly URL encoded. + 1:1.10.7-2+deb9u8 [Sat, 15 Feb 2020 10:25:11 +0000] Chris Lamb <lamby@debian.org>: * CVE-2020-7471: Prevent a Potential SQL injection via StringAgg(delimiter). <http://10.200.17.11/4.4-4/#6557579374626047637>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-4] 87c0cd915c Bug #51543: python-django 1:1.10.7-2+deb9u9 doc/errata/staging/python-django.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
<http://errata.software-univention.de/ucs/4.4/629.html>