python-django: security bump to version 1.10.7
Fixes the following security issues: Since 1.10.3: CVE-2016-9013 - User with hardcoded password created when running tests on Oracle Marti Raudsepp reported that a user with a hardcoded password is created when running tests with an Oracle database. CVE-2016-9014 - DNS rebinding vulnerability when DEBUG=True Aymeric Augustin discovered that Django does not properly validate the Host header against settings.ALLOWED_HOSTS when the debug setting is enabled. A remote attacker can take advantage of this flaw to perform DNS rebinding attacks. Since 1.10.7: CVE-2017-7233 - Open redirect and possible XSS attack via user-supplied numeric redirect URLs It was discovered that is_safe_url() does not properly handle certain numeric URLs as safe. A remote attacker can take advantage of this flaw to perform XSS attacks or to use a Django server as an open redirect. CVE-2017-7234 - Open redirect vulnerability in django.views.static.serve() Phithon from Chaitin Tech discovered an open redirect vulnerability in the django.views.static.serve() view. Note that this view is not intended for production use. Cc: Oli Vogt <oli.vogt.pub01@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
parent
833082fdb4
commit
3a66a81b7a
|
@ -1,3 +1,3 @@
|
|||
# md5 from https://pypi.python.org/pypi/django/json, sha256 locally computed
|
||||
md5 5342e77374b2acd2eafa86d2bb68f8c9 Django-1.10.2.tar.gz
|
||||
sha256 e127f12a0bfb34843b6e8c82f91e26fff6445a7ca91d222c0794174cf97cbce1 Django-1.10.2.tar.gz
|
||||
md5 693dfeabad62c561cb205900d32c2a98 Django-1.10.7.tar.gz
|
||||
sha256 593d779dbc2350a245c4f76d26bdcad58a39895e87304fe6d725bbdf84b5b0b8 Django-1.10.7.tar.gz
|
||||
|
|
|
@ -4,10 +4,10 @@
|
|||
#
|
||||
################################################################################
|
||||
|
||||
PYTHON_DJANGO_VERSION = 1.10.2
|
||||
PYTHON_DJANGO_VERSION = 1.10.7
|
||||
PYTHON_DJANGO_SOURCE = Django-$(PYTHON_DJANGO_VERSION).tar.gz
|
||||
# The official Django site has an unpractical URL
|
||||
PYTHON_DJANGO_SITE = https://pypi.python.org/packages/57/9e/59444485f092b6ed4f1931e7d2e13b67fdab967c041d02f58a0d1dab8c23
|
||||
PYTHON_DJANGO_SITE = https://pypi.python.org/packages/15/b4/d4bb7313e02386bd23a60e1eb5670321313fb67289c6f36ec43bce747aff
|
||||
PYTHON_DJANGO_LICENSE = BSD-3-Clause
|
||||
PYTHON_DJANGO_LICENSE_FILES = LICENSE
|
||||
PYTHON_DJANGO_SETUP_TYPE = setuptools
|
||||
|
|
Loading…
Reference in a new issue