Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
package/python-django: security bump to version 5.0.8
Django 5.0.7 fixes the following CVEs: * CVE-2024-38875: Potential denial-of-service vulnerability in django.utils.html.urlize() * CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords * CVE-2024-39330: Potential directory-traversal via Storage.save() * CVE-2024-39614: Potential denial-of-service vulnerability in get_supported_language_variant() Django 5.0.8 fixes the following CVEs: * CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat() * CVE-2024-41990: Potential denial-of-service vulnerability in django.utils.html.urlize() * CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget * CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list() Further release Notes: https://docs.djangoproject.com/en/5.0/releases/ Signed-off-by: Marcus Hoffmann <[email protected]> Signed-off-by: Thomas Petazzoni <[email protected]>
- Loading branch information