Ubuntu
python-django package

security vulnerabiity in django i18n system

Bug #157903 reported by Jan Claeys
260
Affects Status Importance Assigned to Milestone
Feisty Backports
Fix Released
Undecided
Unassigned
python-django (Debian)
Fix Released
Unknown
python-django (Ubuntu)
Fix Released
Medium
William Grant
Feisty
Fix Released
Undecided
William Grant
Gutsy
Fix Released
Undecided
William Grant
Hardy
Fix Released
Medium
William Grant

Bug Description

Binary package hint: python-django

Upstream Django project has released a security vulnerability report:
http://www.djangoproject.com/weblog/2007/oct/26/security-fix/

Doesn't seem to be critical to me, but might still be good to fix this...

William Grant (wgrant)
Changed in python-django:
importance: Undecided → Medium
status: New → Confirmed
status: New → Confirmed
status: New → Confirmed
Revision history for this message
William Grant (wgrant) wrote :

python-django (0.96.1-0ubuntu1) hardy; urgency=low

  * New upstream release
    - SECURITY UPDATE: Denial of service in i18n middleware. (LP: #157903)
    - References:
     + CVE-2007-5712

 -- William Grant <email address hidden> Fri, 09 Nov 2007 13:51:10 +1100

Changed in python-django:
status: Confirmed → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in python-django:
status: Unknown → New
Revision history for this message
William Grant (wgrant) wrote :

Backporters, please backport python-django 0.96.1-0ubuntu1 from Hardy to Feisty.

Changed in python-django:
assignee: nobody → fujitsu
status: Confirmed → In Progress
assignee: nobody → fujitsu
status: Confirmed → In Progress
assignee: nobody → fujitsu
Revision history for this message
William Grant (wgrant) wrote :
Revision history for this message
William Grant (wgrant) wrote :
Bug Watch Updater (bug-watch-updater)
Changed in python-django:
status: New → Fix Released
Revision history for this message
John Dong (jdong) wrote :

Build tested; ack from backporters

Changed in feisty-backports:
status: New → In Progress
Revision history for this message
Sebastien Bacher (seb128) wrote :

security issues should be fixed in security or updates rather than backport

Revision history for this message
William Grant (wgrant) wrote :

seb128: Right, but the security issue is in backports *at the moment*. I don't believe a security upload has ever been performed to -backports, nor does it seem sane to.

Revision history for this message
Sebastien Bacher (seb128) wrote :

does the request stand for 0.96.1-1 which is now the current hardy version?

Revision history for this message
Sebastien Bacher (seb128) wrote :

 * Trying to backport python-django...
  - <python-django_0.96.1.orig.tar.gz: downloading from librarian>
  - <python-django_0.96.1-1.diff.gz: downloading from librarian>
  - <python-django_0.96.1-1.dsc: downloading from librarian>
I: Extracting python-django_0.96.1-1.dsc ... done.
I: Building backport of python-django-0.96.1 as 0.96.1-1~feisty1 ... done.

Changed in feisty-backports:
status: In Progress → Fix Released
Kees Cook (kees)
Changed in python-django:
status: In Progress → Fix Committed
status: In Progress → Fix Committed
Revision history for this message
William Grant (wgrant) wrote :

python-django (0.96-1ubuntu0.1) gutsy-security; urgency=low

  * SECURITY UPDATE: Denial of service in i18n middleware.
  * debian/patches/03_CVE-2007-5712.diff: Add upstream fix. (LP: #157903)
  * References:
    CVE-2007-5712

 -- William Grant <email address hidden> Fri, 09 Nov 2007 23:36:03 +1100

Revision history for this message
William Grant (wgrant) wrote :

python-django (0.95.1-1ubuntu1.1) feisty-security; urgency=low

  * SECURITY UPDATE: Denial of service in i18n middleware.
  * debian/patches/03_CVE-2007-5712.diff: Add upstream fix. (LP: #157903)
  * References:
    CVE-2007-5712

 -- William Grant <email address hidden> Fri, 09 Nov 2007 23:26:08 +1100

Changed in python-django:
status: Fix Committed → Fix Released
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.