[ubuntu/xenial-updates] web2py 2.12.3-1ubuntu0.1 (Accepted)

[Ubuntu Archive Robot]

web2py (2.12.3-1ubuntu0.1) xenial-security; urgency=medium

  * SECURITY UPDATE: remote code execution
   - debian/patches/CVE-2016-3957-1.patch: more secure sessions in
     cookies using json
   - debian/patches/CVE-2016-3957-2.patch: restored pickles in sessions
   - debian/patches/CVE-2016-3957-3.patch: fixed sessions for long keys
   - CVE-2016-3957
   - CVE-2016-3954
   - CVE-2016-3953
  * SECURITY UPDATE: brute force password attack
   - debian/patches/CVE-2016-10321.patch: check if host is denied before
     verifying passwords
   - CVE-2016-10321
  * SECURITY UPDATE: information disclosure
   - debian/patches/CVE-2016-3952-1.patch: do not leak global settings into
     request object
   - debian/patches/CVE-2016-3952-2.patch: adding back cmd_options
   - debian/patches/CVE-2016-3952-3.patch: simplified beautify example
   - debian/patches/CVE-2016-3952-4.patch: fixing error due to removing 
     global settings from request
   - debian/patches/CVE-2016-3952-5.patch: fixing typo on previous patch
   - CVE-2016-3952

Date: 2019-06-21 01:49:13.122760+00:00
Changed-By: Maria Emilia torino <emilia.torino at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/web2py/2.12.3-1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.