This bug was fixed in the package python-django - 1.2.3-1ubuntu0.2.10.10.2 --------------- python-django (1.2.3-1ubuntu0.2.10.10.2) maverick-security; urgency=low
* SECURITY UPDATE: flaw in CSRF handling (LP: #719031) - debian/patches/09_CVE-2011-0696.diff: apply full CSRF validation to all requests, regardless of apparent AJAX origin. This is technically backwards-incompatible, but the security risks have been judged to outweigh the compatibility concerns in this case. See the Django project notes for more information: http://www.djangoproject.com/weblog/2011/feb/08/security/ - CVE-2011-0696 * SECURITY UPDATE: potential XSS in file field rendering - debian/patches/10_admin_widgets-to-unittest.diff: prepare testsuite for security fix tests - debian/patches/11_CVE-2011-0697.diff: properly escape URL in django/contrib/admin/widgets.py - CVE-2011-0697 -- Jamie Strandboge <ja...@ubuntu.com> Tue, 15 Feb 2011 17:04:19 -0600 ** Changed in: python-django (Ubuntu Maverick) Status: Fix Committed => Fix Released ** Changed in: python-django (Ubuntu Lucid) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/719031 Title: SECURITY - multiple vulnerabilities, upgrade needed to 1.2.5 or 1.1.4 -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs