Re: [django-announce] [ANNOUNCE] Security releases issued -- vulnerability in the wild

2013-09-15 Thread Nick Apostolakis
On 16/09/2013 02:45 πμ, Russell Keith-Magee wrote: Django 1.3 and earlier are also affected, but the exposure is smaller. It was the speed of the PBKDF2 hashing function that revealed this problem, and that hasher was introduced in Django 1.4. In Django 1.3 or earlier, SHA1 was the default hashin

Re: [django-announce] [ANNOUNCE] Security releases issued -- vulnerability in the wild

2013-09-15 Thread Russell Keith-Magee
Django 1.3 and earlier are also affected, but the exposure is smaller. It was the speed of the PBKDF2 hashing function that revealed this problem, and that hasher was introduced in Django 1.4. In Django 1.3 or earlier, SHA1 was the default hashing function. As described in the release notes, SHA1 i

Re: [django-announce] [ANNOUNCE] Security releases issued -- vulnerability in the wild

2013-09-15 Thread Nick Apostolakis
On 15/09/2013 03:50 μμ, Russell Keith-Magee wrote: Hi Dig I'm not sure I understand your question. Both releases are security releases; both are available on pip. If you code is based on the 1.5 release of Django, you should now be running 1.5.4. Yours, Russ Magee %-) Hello, is 1.3.x affect

Re: [django-announce] [ANNOUNCE] Security releases issued -- vulnerability in the wild

2013-09-15 Thread Dig
Hi Russell, Got it, and thanks. We will update to 1.5.4 in this week. Regards, Dig On Sep 15, 2013 8:51 PM, "Russell Keith-Magee" wrote: > Hi Dig > > I'm not sure I understand your question. Both releases are security > releases; both are available on pip. If you code is based on the 1.5 > re

Re: [django-announce] [ANNOUNCE] Security releases issued -- vulnerability in the wild

2013-09-15 Thread Russell Keith-Magee
Hi Dig I'm not sure I understand your question. Both releases are security releases; both are available on pip. If you code is based on the 1.5 release of Django, you should now be running 1.5.4. Yours, Russ Magee %-) On Sunday, September 15, 2013, Dig wrote: > And how about 1.5.3 which is anno