Grmbl. The worse is that I wrote everything by hand and my brain started to work *after I finished*.
Pierre-Elliott Bécue <[email protected]> wrote on 28/08/2026 at 18:48:51+0200: > Package: release.debian.org > Severity: normal > Tags: bookworm > X-Debbugs-Cc: [email protected] > Control: affects -1 + src:django-allauth > User: [email protected] > Usertags: pu > > Hello, > > [ Reason ] > django-allauth has seen three CVEs reported, of which two I was able to > find in the version released in stable. > > I cherry-picked the commits from upstream and built a new version > > [ Impact ] > These CVEs are not major, if you believe these changes should not hit > stable it is fine with me. The second patch has a significant impact on production setups as it changes the field to identify an account for Okta and NetIQ. This will happen in forky anyway, but still, it requires a NEWS file and proper information. Here is a new debdiff. > [ Tests ] > Build and autopkgtest tests do cover the changed code > > [ Risks ] > Changes are rather trivial. > > [ Checklist ] > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in (old)stable > [x] the issue is verified as fixed in unstable > > [ Changes ] > * d/p/0004: fix(saml): prevent open redirect with IdP initiated SSO > (Closes: CVE-2026-27982, #1130044) > > This change merely verifies that an url complies with the checks > done with is_safe_url, as defined in the DefaultAdapter in > allauth/account/adapter.py > * d/p/0005: fix(socialaccount): use ``sub`` in Okta/NetIQ > (Closes: CVE-2025-65431; #1123085) > > This change moves from a mutable field to a non-mutable one > for the identifier used for the third party account in NetIQ and > Okta, which means that as soon as the user would change their > preferred_username, it would induce the creation of another account > upon relogin.
django-allauth.debdiff
Description: Binary data
signature.asc
Description: PGP signature
