Django security update 1.3.2

Status changed to 'Confirmed' because the bug affects multiple users.

Quick heads-up: a Python 2.4 compatibility issue has been found in the 1.3.2 package. A patch has landed upstream:

https://github.com/django/django/commit/d0d5dc6cd76f01c8a71b677357ad2f702cb54416

And we (Django) will be issuing 1.3.3 as a bugfix release for this within the next 24 hours.

Fixed in 1.4.1, which is in quantal

Since there are non-security changes in 1.3.2/3, we'll cherrypick just the commits for precise and oneiric. Debian has 1.2 patches we can use for natty. I did not check applicability to hardy or lucid.

Fix for precise.

I did build the package. Given the upstream test suite that runs during build, I think that should be sufficient given that the change is the exact upstream change.

Thanks, Scott, I'll review and push.

Status changed to 'Confirmed' because the bug affects multiple users.

This bug was fixed in the package python-django - 1.3.1-4ubuntu1.2

---------------
python-django (1.3.1-4ubuntu1.2) precise-security; urgency=high

  [ Scott Kitterman ]
  * SECURITY UPDATE: multiple issues (LP: #1031733)
  * References CVE-2012-3442 CVE-2012-3443 CVE-2012-3444
    https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/
  * New upstream release to address three security issues:
    - Cross-site scripting in authentication views
    - Denial-of-service in image validation
    - Denial-of-service via get_image_dimensions()
  * Added debian/patches/security_http_redirects,
    security_image_uploading_two, and security_image_uploading cherry picked
    from upstream git

  [ Marc Deslauriers ]
  * debian/patches/security_http_redirects: remove unrelated changes, add
    python 2.4 regression fix.
 -- Marc Deslauriers <email address hidden> Thu, 06 Sep 2012 08:36:28 -0400

This bug was fixed in the package python-django - 1.1.1-2ubuntu1.5

---------------
python-django (1.1.1-2ubuntu1.5) lucid-security; urgency=low

  * SECURITY UPDATE: Cross-site scripting in authentication views
    (LP: #1031733)
    - debian/patches/16_fix_cross_site_scripting_in_authentication.diff:
      fix unsafe redirects indjango/http/__init__.py. Patch backported from
      Debian Squeeze and fixed for python 2.4 compatibility.
    - CVE-2012-3442
  * SECURITY UPDATE: Denial-of-service in image validation (LP: #1031733)
    - debian/patches/17_fix_dos_in_image_validation.diff: call verify()
      immediately after the constructor in django/forms/fields.py.
    - CVE-2012-3443
  * SECURITY UPDATE: Denial-of-service via get_image_dimensions()
    (LP: #1031733)
    - debian/patches/18_fix_dos_via_get_image_dimensions.diff: don't limit
      chunk size in django/core/files/images.py.
    - CVE-2012-3444
 -- Marc Deslauriers <email address hidden> Thu, 06 Sep 2012 09:56:37 -0400

This bug was fixed in the package python-django - 1.2.5-1ubuntu1.2

---------------
python-django (1.2.5-1ubuntu1.2) natty-security; urgency=low

  * SECURITY UPDATE: Cross-site scripting in authentication views
    (LP: #1031733)
    - debian/patches/16_fix_cross_site_scripting_in_authentication.diff:
      fix unsafe redirects indjango/http/__init__.py, add test case to
      tests/regressiontests/httpwrappers/tests.py. Patch backport taken
      from Debian Squeeze and fixed for python 2.4 compatibility.
    - CVE-2012-3442
  * SECURITY UPDATE: Denial-of-service in image validation (LP: #1031733)
    - debian/patches/17_fix_dos_in_image_validation.diff: call verify()
      immediately after the constructor in django/forms/fields.py.
    - CVE-2012-3443
  * SECURITY UPDATE: Denial-of-service via get_image_dimensions()
    (LP: #1031733)
    - debian/patches/18_fix_dos_via_get_image_dimensions.diff: don't limit
      chunk size in django/core/files/images.py.
    - CVE-2012-3444
 -- Marc Deslauriers <email address hidden> Thu, 06 Sep 2012 09:39:29 -0400

This bug was fixed in the package python-django - 1.3-2ubuntu1.3

---------------
python-django (1.3-2ubuntu1.3) oneiric-security; urgency=low

  [ Scott Kitterman ]
  * SECURITY UPDATE: multiple issues (LP: #1031733)
  * References CVE-2012-3442 CVE-2012-3443 CVE-2012-3444
    https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/
  * New upstream release to address three security issues:
    - Cross-site scripting in authentication views
    - Denial-of-service in image validation
    - Denial-of-service via get_image_dimensions()
  * Added debian/patches/security_http_redirects,
    security_image_uploading_two, and security_image_uploading cherry picked
    from upstream git

  [ Steve Beattie ]
  * added debian/patches/10_fix_testsuite_failure.patch: adjust
    test_week_view_allow_future to ensure the first week of the year is
    selected

  [ Marc Deslauriers ]
  * debian/patches/security_http_redirects: remove unrelated changes, add
    python 2.4 regression fix.
 -- Marc Deslauriers <email address hidden> Thu, 06 Sep 2012 08:40:28 -0400