security vulnerability in django admin

I can confirm this announcement. See also here: http://www.djangoproject.com/weblog/2008/may/14/security/

Applied upstream fix in hardy package.
so, this is the debdiff that should fix this bug in hardy,

Also fixed, with the same patch, for gutsy.

For Intrepid, we should sync or merge 0.96.2 from Debian.
Andrea: can you please do that, given that you merged it last?

Also, please use the patch system in your debdiffs, and create one for Feisty.

Yes, i'd like to do also for intrepid and feisty, just a few day, 'cause i'm really busy. :)
(and for intrepid it's fine a merge...)

Fixed also for feisty. :)

Debdiff that closes the bug for intrepid:

Remaining Ubuntu changes:
      - debian/patches/04_workaround_net_tests.patch run testsuite
        during build process
      - debian/control: Maintainer set to Ubuntu Motu.

Changes dropped:
      - debian/patches/03_dynamicshebang.diff: manage.py created.
        with the right python interpreter.

as discussed in: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460662
and cause debian already change hashbang in binary-post-install to a standard "/usr/bin/python" .

Argh, wrong debdiff for intrepid... this is the right one.

Uploaded, tfyw!

This bug was fixed in the package python-django - 0.96.2-1ubuntu1

---------------
python-django (0.96.2-1ubuntu1) intrepid; urgency=low

  * Also closes LP: #234631: "security vulnerability in django admin"
  * Merge from Debian unstable. Remaining Ubuntu changes:
      - debian/patches/04_workaround_net_tests.patch
      - debian/rules: run testsuite during build process
      - debian/control: Maintainer set to Ubuntu Motu.

python-django (0.96.2-1) unstable; urgency=low

  * New upstream security release. Closes: #481164

 -- Andrea Gasparini <email address hidden> Tue, 20 May 2008 12:31:33 +0200

Andrea, you've made a single-character error in your Feisty debdiff. You left the first 1 out of the version string.

yes, you're right! I controlled that it's only a typo, other versions number and packages are correct.

Attacching a new debdiff.

for intrepid there is a merge in progress for Django 1.0

https://bugs.edge.launchpad.net/ubuntu/+source/python-django/+bug/264191

The feisty-hardy debdiffs all referenced the wrong bug number. I have adjusted that and am reviewing the rest of the patch.

This bug was fixed in the package python-django - 0.96.1-2ubuntu2.1

---------------
python-django (0.96.1-2ubuntu2.1) hardy-security; urgency=low

  * SECURITY UPDATE: security vulnerability in django admin
  * debian/patches/05_CVE-2008-2302_fix.diff: added upstream fix
    escaping request path in login page of admin site.(LP: #234631)
  * References:
    CVE link: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2302
    upstream announce: http://www.djangoproject.com/weblog/2008/may/14/security/
    upstream fix: http://code.djangoproject.com/changeset/7527

 -- Andrea Gasparini <email address hidden> Thu, 29 May 2008 17:00:38 +0200

This bug was fixed in the package python-django - 0.96-1ubuntu0.2

---------------
python-django (0.96-1ubuntu0.2) gutsy-security; urgency=low

  * SECURITY UPDATE: security vulnerability in django admin
  * debian/patches/05_CVE-2008-2302_fix.diff: added upstream fix
    escaping request path in login page of admin site.(LP: #234631)
  * References:
    CVE link: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2302
    upstream announce: http://www.djangoproject.com/weblog/2008/may/14/security/
    upstream fix: http://code.djangoproject.com/changeset/7527

 -- Andrea Gasparini <email address hidden> Thu, 29 May 2008 17:00:38 +0200

This bug was fixed in the package python-django - 0.95.1-1ubuntu1.2

---------------
python-django (0.95.1-1ubuntu1.2) feisty-security; urgency=low

  * SECURITY UPDATE: security vulnerability in django admin
  * debian/patches/05_CVE-2008-2302_fix.diff: added upstream fix
    escaping request path in login page of admin site.(LP: #234631)
  * References:
    CVE link: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2302
    upstream announce: http://www.djangoproject.com/weblog/2008/may/14/security/
    upstream fix: http://code.djangoproject.com/changeset/7527

 -- Andrea Gasparini <email address hidden> Thu, 03 Jun 2008 09:08:38 +0200