--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2020-232e4f7411
2020-07-03 00:24:47.024792
--------------------------------------------------------------------------------
Name : python-django
Product : Fedora EPEL 8
Version : 2.2.13
Release : 1.el8
URL :
http://www.djangoproject.com/
Summary : A high-level Python Web framework
Description :
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as
much as possible and adhering to the DRY (Don't Repeat Yourself)
principle.
--------------------------------------------------------------------------------
Update Information:
Update to 2.2.13 - Security fix for CVE-2020-7471 - Security fix for
CVE-2020-9402 - Security fix for CVE-2020-13254 - Security fix for
CVE-2020-13596
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 7 2020 Miro Hron��ok <mhroncok(a)redhat.com> - 2.2.13-1
- Update to 2.2.13
- Security fix for CVE-2020-7471 (rhbz#1798519)
- Security fix for CVE-2020-9402 (rhbz#1810094)
- Security fix for CVE-2020-13254 (rhbz#1843616)
- Security fix for CVE-2020-13596 (rhbz#1843626)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1798515 - CVE-2020-7471 django: potential SQL injection via
StringAgg(delimiter)
https://bugzilla.redhat.com/show_bug.cgi?id=1798515
[ 2 ] Bug #1810088 - CVE-2020-9402 django: potential SQL injection via
"tolerance" parameter in GIS functions and aggregates on Oracle
https://bugzilla.redhat.com/show_bug.cgi?id=1810088
[ 3 ] Bug #1843614 - CVE-2020-13254 django: potential data leakage via malformed
memcached keys
https://bugzilla.redhat.com/show_bug.cgi?id=1843614
[ 4 ] Bug #1843625 - CVE-2020-13596 django: possible XSS via admin
ForeignKeyRawIdWidget
https://bugzilla.redhat.com/show_bug.cgi?id=1843625
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update python-django' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------