package/python-django: security bump to version 3.0.10
authorPeter Korsgaard <peter@korsgaard.com>
Tue, 1 Sep 2020 14:22:22 +0000 (16:22 +0200)
committerPeter Korsgaard <peter@korsgaard.com>
Tue, 1 Sep 2020 18:14:43 +0000 (20:14 +0200)
commiteaefa775ed7ec0062d21e3ac37f10e93b990ad5b
tree6b24d8876489fd2410c0668f09fc1d0e328dc9ef
parent4f315bb7ec3b7774e40250993ae1b01c1a1f33e4
package/python-django: security bump to version 3.0.10

Fixes the following security issues:

CVE-2020-24583: Incorrect permissions on intermediate-level directories on Python 3.7+
On Python 3.7+, FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to
intermediate-level directories created in the process of uploading files and
to intermediate-level collected static directories when using the
collectstatic management command.

You should review and manually fix permissions on existing
intermediate-level directories.

CVE-2020-24584: Permission escalation in intermediate-level directories of
the file system cache on Python 3.7+
On Python 3.7+, the intermediate-level directories of the file system cache
had the system’s standard umask rather than 0o077 (no group or others
permissions).

https://docs.djangoproject.com/en/dev/releases/3.0.10/

In addition, 3.0.8..10 contains a number of bugfixes.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/python-django/python-django.hash
package/python-django/python-django.mk