Subject: CVS commit: pkgsrc/www/py-django3
From: Adam Ciarcinski
Date: 2021-05-14 20:54:38
Message id: 20210514185438.95CAEFA95@cvs.NetBSD.org

Log Message:
py-django3: updated to 3.2.3

Django 3.2.3 fixes several bugs in 3.2.2.

Bugfixes

Prepared for mysqlclient > 2.0.3 support.
Fixed a regression in Django 3.2 that caused the incorrect filtering of \ 
querysets combined with the | operator.
Fixed a regression in Django 3.2.1 where saving FileField would raise a \ 
SuspiciousFileOperation even when a custom upload_to returns a valid file path.

Django 3.2.2 fixes a security issue and a bug in 3.2.1.

CVE-2021-32052: Header injection possibility since URLValidator accepted \ 
newlines in input on Python 3.9.5+

On Python 3.9.5+, URLValidator didn’t prohibit newlines and tabs. If you used \ 
values with newlines in HTTP response, you could suffer from header injection \ 
attacks. Django itself wasn’t vulnerable because HttpResponse prohibits \ 
newlines in HTTP headers.

Moreover, the URLField form field which uses URLValidator silently removes \ 
newlines and tabs on Python 3.9.5+, so the possibility of newlines entering your \ 
data only existed if you are using this validator outside of the form fields.

This issue was introduced by the bpo-43882 fix.

Files:
RevisionActionfile
1.15modifypkgsrc/www/py-django3/Makefile
1.15modifypkgsrc/www/py-django3/distinfo