Subject: CVS commit: pkgsrc/www/py-django3
From: Adam Ciarcinski
Date: 2022-04-20 14:29:47
Message id: 20220420122947.708FCFB1A@cvs.NetBSD.org

Log Message:
py-django3: updated to 3.2.13

Django 3.2.13 fixes two security issues with severity “high” in 3.2.12 and a \ 
regression in 3.2.4.

CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and \ 
extra()

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL \ 
injection in column aliases, using a suitably crafted dictionary, with \ 
dictionary expansion, as the **kwargs passed to these methods.

CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL

QuerySet.explain() method was subject to SQL injection in option names, using a \ 
suitably crafted dictionary, with dictionary expansion, as the **options \ 
argument.

Bugfixes

Fixed a regression in Django 3.2.4 that caused the auto-reloader to no longer \ 
detect changes when the DIRS option of the TEMPLATES setting contained an empty \ 
string

Files:
RevisionActionfile
1.28modifypkgsrc/www/py-django3/Makefile
1.27modifypkgsrc/www/py-django3/distinfo