package/python-django: security bump to version 3.0.7
authorPeter Korsgaard <peter@korsgaard.com>
Thu, 4 Jun 2020 12:39:26 +0000 (14:39 +0200)
committerThomas Petazzoni <thomas.petazzoni@bootlin.com>
Thu, 4 Jun 2020 20:48:29 +0000 (22:48 +0200)
commit36d78abceb79ad8b8ea73054cd2e6fcfcc835c4f
tree46be0bd51a5403321e66add4c71be1c0ce5bbd09
parent3bc5df8cb158fdb877f4935b29946f1bc69981da
package/python-django: security bump to version 3.0.7

Fixes the following security issues:

- CVE-2020-13254: Potential data leakage via malformed memcached keys

  In cases where a memcached backend does not perform key validation,
  passing malformed cache keys could result in a key collision, and
  potential data leakage.  In order to avoid this vulnerability, key
  validation is added to the memcached cache backends.

- CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget

  Query parameters for the admin ForeignKeyRawIdWidget were not properly URL
  encoded, posing an XSS attack vector.  ForeignKeyRawIdWidget now ensures
  query parameters are correctly URL encoded.

For details, see the announcement:
https://docs.djangoproject.com/en/dev/releases/3.0.7/

Additionally, 3.0.5..3.0.7 contains a number of non-security related
bugfixes.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
package/python-django/python-django.hash
package/python-django/python-django.mk