web2py (2.12.3-1ubuntu0.1) xenial-security; urgency=medium
* SECURITY UPDATE: remote code execution
- debian/patches/CVE-2016-3957-1.patch: more secure sessions in
cookies using json
- debian/patches/CVE-2016-3957-2.patch: restored pickles in sessions
- debian/patches/CVE-2016-3957-3.patch: fixed sessions for long keys
- CVE-2016-3957
- CVE-2016-3954
- CVE-2016-3953
* SECURITY UPDATE: brute force password attack
- debian/patches/CVE-2016-10321.patch: check if host is denied before
verifying passwords
- CVE-2016-10321
* SECURITY UPDATE: information disclosure
- debian/patches/CVE-2016-3952-1.patch: do not leak global settings into
request object
- debian/patches/CVE-2016-3952-2.patch: adding back cmd_options
- debian/patches/CVE-2016-3952-3.patch: simplified beautify example
- debian/patches/CVE-2016-3952-4.patch: fixing error due to removing
global settings from request
- debian/patches/CVE-2016-3952-5.patch: fixing typo on previous patch
- CVE-2016-3952
Date: 2019-06-21 01:49:13.122760+00:00
Changed-By: Maria Emilia torino <emilia.tor...@canonical.com>
https://launchpad.net/ubuntu/+source/web2py/2.12.3-1ubuntu0.1
Sorry, changesfile not available.
--
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/xenial-changes
