[ubuntu/precise-updates] python-django 1.3.1-4ubuntu1.13 (Accepted)

[Ubuntu Archive Robot]

python-django (1.3.1-4ubuntu1.13) precise-security; urgency=medium

  * SECURITY UPDATE: WSGI header spoofing via underscore/dash conflation
    - debian/patches/CVE-2015-0219.patch: strip headers with underscores in
      django/core/servers/basehttp.py, added test to
      tests/regressiontests/servers/tests.py.
    - CVE-2015-0219
  * SECURITY UPDATE: Mitigated possible XSS attack via user-supplied
    redirect URLs
    - debian/patches/CVE-2015-0220.patch: filter url in
      django/utils/http.py, added test to
      tests/regressiontests/utils/http.py.
    - CVE-2015-0220
  * SECURITY UPDATE: Denial-of-service attack against
    django.views.static.serve
    - debian/patches/CVE-2015-0221.patch: limit large files in
      django/views/static.py, added test to
      tests/regressiontests/views/media/long-line.txt,
      tests/regressiontests/views/tests/static.py.
    - CVE-2015-0221

Date: 2015-01-13 15:21:11.822527+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.13
-------------- next part --------------
Sorry, changesfile not available.