Format: 1.8
Date: Mon, 04 Mar 2013 10:33:54 -0500
Source: python-django
Binary: python-django python-django-doc
Architecture: all i386_translations
Version: 1.3-2ubuntu1.6
Distribution: oneiric
Urgency: low
Maintainer: Ubuntu/amd64 Build Daemon <buildd@roseapple.buildd>
Changed-By: Marc Deslauriers <marc.deslauriers@ubuntu.com>
Description: 
 python-django - High-level Python web development framework
 python-django-doc - High-level Python web development framework (documentation)
Launchpad-Bugs-Fixed: 1089337 1130445
Changes: 
 python-django (1.3-2ubuntu1.6) oneiric-security; urgency=low
 .
   * SECURITY UPDATE: host header poisoning (LP: #1089337)
     - debian/patches/fix_get_host.patch: tighten host header validation in
       django/http/__init__.py, add tests to
       tests/regressiontests/requests/tests.py.
     - https://www.djangoproject.com/weblog/2012/dec/10/security/
     - No CVE number
   * SECURITY UPDATE: redirect poisoning (LP: #1089337)
     - debian/patches/fix_redirect_poisoning.patch: tighten validation in
       django/contrib/auth/views.py,
       django/contrib/comments/views/comments.py,
       django/contrib/comments/views/moderation.py,
       django/contrib/comments/views/utils.py, django/utils/http.py,
       django/views/i18n.py, add tests to
       tests/regressiontests/comment_tests/tests/comment_view_tests.py,
       tests/regressiontests/comment_tests/tests/moderation_view_tests.py,
       tests/regressiontests/views/tests/i18n.py.
     - https://www.djangoproject.com/weblog/2012/dec/10/security/
     - No CVE number
   * SECURITY UPDATE: host header poisoning (LP: #1130445)
     - debian/patches/add_allowed_hosts.patch: add new ALLOWED_HOSTS setting
       to django/conf/global_settings.py,
       django/conf/project_template/settings.py,
       django/http/__init__.py, django/test/utils.py, add docs to
       docs/ref/settings.txt, add tests to
       tests/regressiontests/requests/tests.py.
     - https://www.djangoproject.com/weblog/2013/feb/19/security/
     - No CVE number
   * SECURITY UPDATE: XML attacks (LP: #1130445)
     - debian/patches/CVE-2013-166x.patch: forbid DTDs, entity expansion,
       and external entities/DTDs in
       django/core/serializers/xml_serializer.py, add tests to
       tests/regressiontests/serializers_regress/tests.py.
     - https://www.djangoproject.com/weblog/2013/feb/19/security/
     - CVE-2013-1664
     - CVE-2013-1665
   * SECURITY UPDATE: Data leakage via admin history log (LP: #1130445)
     - debian/patches/CVE-2013-0305.patch: add permission checks to history
       view in django/contrib/admin/options.py, add tests to
       tests/regressiontests/admin_views/tests.py.
     - https://www.djangoproject.com/weblog/2013/feb/19/security/
     - CVE-2013-0305
   * SECURITY UPDATE: Formset denial-of-service (LP: #1130445)
     - debian/patches/CVE-2013-0306.patch: limit maximum number of forms in
       django/forms/formsets.py, add docs to docs/topics/forms/formsets.txt,
       docs/topics/forms/modelforms.txt, add tests to
       tests/regressiontests/forms/tests/formsets.py.
     - https://www.djangoproject.com/weblog/2013/feb/19/security/
     - CVE-2013-0306
Checksums-Sha1: 
 d1914c27497ce80533ecc7ff90b45dcec60259b4 4300072 python-django_1.3-2ubuntu1.6_all.deb
 fe634e34c9632fab87bdc6772c7c52ee666c7260 1990488 python-django-doc_1.3-2ubuntu1.6_all.deb
 6c19e45eb6142cfec1d5d9573c6ce20518ce2880 4323733 python-django_1.3-2ubuntu1.6_i386_translations.tar.gz
Checksums-Sha256: 
 a57142be915af4be7f89d91fd2144342936c093cc9ccc45384f32a20bca24b96 4300072 python-django_1.3-2ubuntu1.6_all.deb
 50c51fd4875ddc79fed86c461545bb10e1d9839643261b3aa4afe42b3f6945cb 1990488 python-django-doc_1.3-2ubuntu1.6_all.deb
 29d4b8301c0a44c9740e076855a41be789782752136c1b2a943176a8741b1499 4323733 python-django_1.3-2ubuntu1.6_i386_translations.tar.gz
Files: 
 4f71f5672d1bd725ca4f5d2ce62c6b21 4300072 python optional python-django_1.3-2ubuntu1.6_all.deb
 3faf6f00f9a880cda0ef0028ac95005e 1990488 doc optional python-django-doc_1.3-2ubuntu1.6_all.deb
 7c5316d5b756c677d05b8b3a9b87b154 4323733 raw-translations - python-django_1.3-2ubuntu1.6_i386_translations.tar.gz
Original-Maintainer: Chris Lamb <lamby@debian.org>