Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.3070 python-django security update for Debian 13 August 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: python-django Publisher: Debian Operating System: Debian GNU/Linux 9 Debian GNU/Linux 10 Impact/Access: Modify Arbitrary Files -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2019-14235 CVE-2019-14234 CVE-2019-14233 CVE-2019-14232 Reference: ESB-2019.3027 ESB-2019.2894 Original Bulletin: http://www.debian.org/security/2019/dsa-4498 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4498-1 security@debian.org https://www.debian.org/security/ Sebastien Delafond August 12, 2019 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : python-django CVE ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Debian Bug : 934026 Several vulnerabilities were discovered in python-django, a web development framework. They could lead to remote denial-of-service or SQL injection, For the oldstable distribution (stretch), these problems have been fixed in version 1:1.10.7-2+deb9u6. For the stable distribution (buster), these problems have been fixed in version 1.11.23-1~deb10u1. We recommend that you upgrade your python-django packages. For the detailed security status of python-django please refer to its security tracker page at: https://security-tracker.debian.org/tracker/python-django Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl1RKSsACgkQEL6Jg/PV nWSP1wf+Ik+YEcDwjJeK/QW060xu3WA4Y+TE2PYFkgtJSL9+wkDDPA2U82aHpVD3 hn253cl//sBYsTTFC/UwpW+y6yP+FmczdxQt+jTLyeKzq/tOZlhkutLHwrrw4OEB e8XE0BhrwSFWInnkLxjjtCscHr6AA1Jt2GuVnhe6isZpbmvxHDNUDPHXRcVU7reX l0INrcv43XIqcxYzNAQFLQKWzv6PzJcUsQJgvnbtW90pQCxp7UwW01H/Wx7FVfBn 78qbXWp+wRewGsJPv7Kjy6keUSck2I/ew0+X6efYAez/X1vgakp3/NGWMh2VzM8d DdW2RhKU/PTEFe9t+1gTXhR1ZbOXZg== =tCmt - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXVIA3GaOgq3Tt24GAQjMTg/9EZxVE875nLzJc3q1NWnYFCs/4Rtoeob/ XvaUZPPv3dMqb8ydaLPtRo9uCFNhz7jRy+ac83u25+OI8mSCGmxX5aCIu1onygMM joygr1khkTxJ3E3DNG0fWsq8lisJ3CPaPFk/AMTT+0XMRHlkacfWMoS9+8d4mDnk dvOegyCWjVouYd3ajqEMgzaMTYAHwDg45lTLsrXlV9U05/J1Mh7skNyaa6l36QiD r2GsUnnHEBlJ325aV2z7G4ANpxHG5QDzUnsXxDsQvRRfKPAmabQSeNptxK/DHaGT g76WChjD50IZBkXLdHGmUhDgi9j6qCoibB2ABCCDtKsvaqyVxJABqgrquE8a3YIY rqanip6PC7oGu5mG0SJS4R2CaJoemZlOj1tcCOUU3T+yh09dPHoVbetVOwmlN+d/ TtmMzHwX8RtsDgxxCG9Dh7BeZfA9k8Dswo8FLI5mJzsa+G2fKr7M4Ubg3c7Wp17T +dhj7UGdc18+95HROVZKa4B3dPfLp7mw7XiQ5g68wWXB4IkbVZyhq/8BkXLxHhNC bd9uVe2YtBhZSrj2Ztpe/ftueEUPicpA/SDU5roozdNgp5v08WGPsiy+kpvy8sRh npoGu1OEPXQKrKyXV6xhFyKcaIhDRovhfooYmJYxUzyRKL6uSsf6QS+hnRs0KYOu WKu3C3oufUs= =MQcU -----END PGP SIGNATURE-----