[ubuntu/trusty-security] python-django 1.6.1-2ubuntu0.6 (Accepted)

[Marc Deslauriers]

python-django (1.6.1-2ubuntu0.6) trusty-security; urgency=medium

  * SECURITY UPDATE: WSGI header spoofing via underscore/dash conflation
    - debian/patches/CVE-2015-0219.patch: strip headers with underscores in
      django/core/servers/basehttp.py, added blurb to
      docs/howto/auth-remote-user.txt, added test to
      tests/servers/test_basehttp.py.
    - CVE-2015-0219
  * SECURITY UPDATE: Mitigated possible XSS attack via user-supplied
    redirect URLs
    - debian/patches/CVE-2015-0220.patch: filter url in
      django/utils/http.py, added test to tests/utils_tests/test_http.py.
    - CVE-2015-0220
  * SECURITY UPDATE: Denial-of-service attack against
    django.views.static.serve
    - debian/patches/CVE-2015-0221.patch: limit large files in
      django/views/static.py, added test to
      tests/view_tests/media/long-line.txt,
      tests/view_tests/tests/test_static.py.
    - CVE-2015-0221
  * SECURITY UPDATE: Database denial-of-service with
    ModelMultipleChoiceField
    - debian/patches/CVE-2015-0222.patch: check values in
      django/forms/models.py, added test to tests/model_forms/tests.py.
    - CVE-2015-0222

python-django (1.6.1-2ubuntu0.5) trusty-proposed; urgency=medium

  * debian/patches/99_fix_multipart_base64_decoding_large_files.patch:
    Fix Multipart base64 file decoding with large files ensuring that the
    actual base64 content has a length a multiple of 4. (LP: #1363348)
  * debian/patches/

Date: 2015-01-13 13:51:34.802201+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/python-django/1.6.1-2ubuntu0.6
-------------- next part --------------
Sorry, changesfile not available.