[ubuntu/focal-security] python-django 2:2.2.12-1ubuntu0.9 (Accepted)

[Marc Deslauriers]

python-django (2:2.2.12-1ubuntu0.9) focal-security; urgency=medium

  * SECURITY UPDATE: Denial-of-service possibility in
    UserAtributeSimilarityValidator
    - debian/patches/CVE-2021-45115.patch: prevent DoS in
      django/contrib/auth/password_validation.py,
      docs/topics/auth/passwords.txt, tests/auth_tests/test_validators.py.
    - CVE-2021-45115
  * SECURITY UPDATE: Potential information disclosure in dictsort template
    filter
    - debian/patches/CVE-2021-45116.patch: properly handle private
      variables in django/template/defaultfilters.py,
      docs/ref/templates/builtins.txt,
      tests/template_tests/filter_tests/test_dictsort.py,
      tests/template_tests/filter_tests/test_dictsortreversed.py.
    - CVE-2021-45116
  * SECURITY UPDATE: Potential directory-traversal via Storage.save()
    - debian/patches/CVE-2021-31542-2.patch: fix regression caused by fix
      for CVE-2021-31542, and add allow_relative_path parameter to
      validate_file_name(), required by the following patch.
    - debian/patches/CVE-2021-45452.patch: fix path traversal in
      django/core/files/storage.py,
      tests/file_storage/test_generate_filename.py,
      tests/file_storage/tests.py.
    - CVE-2021-45452

Date: 2022-01-04 14:17:11.401476+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/python-django/2:2.2.12-1ubuntu0.9
-------------- next part --------------
Sorry, changesfile not available.