Path to this page:
Subject: CVS commit: pkgsrc/www/py-django3
From: Adam Ciarcinski
Date: 2021-05-14 20:54:38
Message id: 20210514185438.95CAEFA95@cvs.NetBSD.org
Log Message:
py-django3: updated to 3.2.3
Django 3.2.3 fixes several bugs in 3.2.2.
Bugfixes
Prepared for mysqlclient > 2.0.3 support.
Fixed a regression in Django 3.2 that caused the incorrect filtering of \
querysets combined with the | operator.
Fixed a regression in Django 3.2.1 where saving FileField would raise a \
SuspiciousFileOperation even when a custom upload_to returns a valid file path.
Django 3.2.2 fixes a security issue and a bug in 3.2.1.
CVE-2021-32052: Header injection possibility since URLValidator accepted \
newlines in input on Python 3.9.5+
On Python 3.9.5+, URLValidator didn’t prohibit newlines and tabs. If you used \
values with newlines in HTTP response, you could suffer from header injection \
attacks. Django itself wasn’t vulnerable because HttpResponse prohibits \
newlines in HTTP headers.
Moreover, the URLField form field which uses URLValidator silently removes \
newlines and tabs on Python 3.9.5+, so the possibility of newlines entering your \
data only existed if you are using this validator outside of the form fields.
This issue was introduced by the bpo-43882 fix.
Files: