ALT-PU-2021-4975: package python-module-django update to version 1.11.29-alt2
Описание
This update upgrades python-module-django to version 1.11.29-alt2.
Устраненные уязвимости6
Ссылки4
GHSA-3gh2-xw74-jmcw
https://github.com/advisories/GHSA-3gh2-xw74-jmcwGHSA-hmr4-m2h5-33qx
https://github.com/advisories/GHSA-hmr4-m2h5-33qxGHSA-vfq6-hq5r-27r6
https://github.com/advisories/GHSA-vfq6-hq5r-27r6Связанные уязвимости
ALT-PU-2020-1708: package `python3-module-django2.2` update to version 2.2.12-alt1
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows a ...