NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/python-django: security bump to version 4.1.12

Browse Source 
Fixes the following security issue:

CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator

Following the fix for CVE-2019-14232, the regular expressions used in the
implementation of django.utils.text.Truncator’s chars() and words() methods
(with html=True) were revised and improved.  However, these regular
expressions still exhibited linear backtracking complexity, so when given a
very long, potentially malformed HTML input, the evaluation would still be
slow, leading to a potential denial of service vulnerability.

The chars() and words() methods are used to implement the truncatechars_html
and truncatewords_html template filters, which were thus also vulnerable.

The input processed by Truncator, when operating in HTML mode, has been
limited to the first five million characters in order to avoid potential
performance and memory issues.

https://www.djangoproject.com/weblog/2023/oct/04/security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Peter Korsgaard 2023-10-30 08:35:24 +01:00
parent 5d6f22b9dc
commit ec7785adc8
2 changed files with 4 additions and 4 deletions

4
package/python-django/python-django.hash
View File

@ -1,5 +1,5 @@
# md5, sha256 from https://pypi.org/pypi/django/json
md5 3720c85a8c25cacbce2f95d345d0f5ad Django-4.1.10.tar.gz
sha256 56343019a9fd839e2e5bf203daf45f25af79d5bffa4c71d56eae4f4404d82ade Django-4.1.10.tar.gz
md5 6f95e92e5e8964c4a1e00e2fcaadf437 Django-4.1.12.tar.gz
sha256 d02483ad49872238fa59875c1269293fe4f17ecee13c121893607cc0b284696b Django-4.1.12.tar.gz
# Locally computed sha256 checksums
sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE

4
package/python-django/python-django.mk
View File

@ -4,10 +4,10 @@
#
################################################################################
PYTHON_DJANGO_VERSION = 4.1.10
PYTHON_DJANGO_VERSION = 4.1.12
PYTHON_DJANGO_SOURCE = Django-$(PYTHON_DJANGO_VERSION).tar.gz
# The official Django site has an unpractical URL
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/70/d4/eded564fa5928f68771d082ec0eef4d023f9d19dfa1d2923305bc3e62afe
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/68/76/b1cf87eda3bf5b2d7dd9a23bb4df70ea5511e426a54a04ed2c4ca2ff67cd
PYTHON_DJANGO_LICENSE = BSD-3-Clause
PYTHON_DJANGO_LICENSE_FILES = LICENSE
PYTHON_DJANGO_CPE_ID_VENDOR = djangoproject