Upstream has issued an advisory on March 6: https://www.djangoproject.com/weblog/2018/mar/06/security-releases/ The issues are fixed upstream in 1.8.19. Mageia 5 and Mageia 6 are also affected.
Whiteboard: (none) => MGA6TOOStatus comment: (none) => Fixed upstream in 1.8.19
Assigning to the python stack maintainers
Assignee: bugsquad => pythonCC: (none) => marja11
Assignee: python => smelrorCC: (none) => smelror
Advisory ======== The python-django package has been updated to fix 2 security issues. CVE-2018-7536: Denial-of-service possibility in urlize and urlizetrunc template filters. CVE-2018-7537: Denial-of-service possibility in truncatechars_html and truncatewords_html template filters. References ========== https://www.djangoproject.com/weblog/2018/mar/06/security-releases/ https://security-tracker.debian.org/tracker/CVE-2018-7536 https://security-tracker.debian.org/tracker/CVE-2018-7537 Files ===== These files are uploaded to core/updates_testing python-django-1.8.19-1.mga6 python-django-bash-completion-1.8.19-1.mga6 python3-django-1.8.19-1.mga6 python-django-doc-1.8.19-1.mga6 from python-django-1.8.19-1.mga6.src.rpm
Whiteboard: MGA6TOO => (none)Assignee: smelror => qa-bugsVersion: Cauldron => 6
The package has also been updated in Cauldron.
Advisory uploaded Procedure: https://bugs.mageia.org/show_bug.cgi?id=17860#c7
Keywords: (none) => advisory, has_procedure
Ubuntu has issued an advisory for this on March 6: https://usn.ubuntu.com/3591-1/
Severity: normal => major
Mageia 6 :: x86_64 Clean update. Following recommended test - comment 4. $ django-admin startproject mysite $ ls mysite manage.py* mysite Continued to the point where the welcome message appears in the browser. Ignored the exhortation to get to work... This appears on the command line: [12/Mar/2018 10:30:16] "GET / HTTP/1.1" 200 1767 [12/Mar/2018 10:30:16] "GET /favicon.ico HTTP/1.1" 404 1936 [12/Mar/2018 10:30:17] "GET /favicon.ico HTTP/1.1" 404 1936 Restarted the test from the beginning using python3 and observed the welcome message at localhost:8000/ in firefox. Output was the same under both versions of python and agreed with the resiults of the tests for bug 17860.
CC: (none) => tarazed25Whiteboard: (none) => MGA6-64-OK
Validating this. Would sysadmins please push to updates.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0166.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED